CVE-2026-22487: 
WordPress vulnerability analysis and mitigation

CVE-2026-22487 is a Missing Authorization vulnerability in the baqend Speed Kit WordPress plugin that allows authenticated low-privileged users to exploit incorrectly configured access control security levels. It affects Speed Kit versions from n/a through 2.0.2 (inclusive). The vulnerability was published on January 8, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before allowing certain actions to be executed. An authenticated attacker with low privileges can send crafted network requests to exploit incorrectly configured access control levels within the plugin, resulting in unauthorized data modification. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Feedly).

Successful exploitation allows a low-privileged authenticated attacker to modify application data or plugin-controlled resources without proper authorization, resulting in a low integrity impact. There is no confidentiality or availability impact reported. The scope is limited to the affected WordPress installation running the vulnerable Speed Kit plugin (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the baqend Speed Kit WordPress plugin to version 2.0.3 or later, which addresses the missing authorization issue. No specific configuration-based workaround has been publicly documented. Site administrators should audit user roles and restrict plugin access to trusted accounts as a precautionary measure until the update is applied (Feedly).