CVE-2026-22445: 
WordPress vulnerability analysis and mitigation

CVE-2026-22445 is a Missing Authorization vulnerability in the Proptech Plugin Apimo Connector WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability was first disclosed on January 22, 2026, and has been updated multiple times as additional affected versions were identified — initially covering versions through 2.6.4, then 2.6.5.1, and most recently through 2.6.5.2. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability allows exploitation of incorrectly configured access control security levels within the plugin, potentially enabling unauthorized modification of data (integrity impact: low). No public technical write-up or proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation results in a limited integrity impact — attackers can perform unauthorized actions or modify data within the scope of the plugin's functionality without any authentication. There is no direct confidentiality or availability impact based on the current CVSS assessment. The affected scope is limited to WordPress sites running the Apimo Connector plugin at or below version 2.6.5.2, with no evidence of lateral movement potential beyond the plugin's operational context (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-22445. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

WordPress site administrators should update the Apimo Connector plugin to a version beyond 2.6.5.2 as soon as a patched release becomes available from Proptech Plugin. In the interim, disabling the plugin on publicly accessible WordPress installations is a viable workaround to eliminate the attack surface. Monitoring WordPress admin logs for unexpected or unauthorized plugin-related actions may help detect exploitation attempts (Patchstack).