CVE-2026-24376: 
WordPress vulnerability analysis and mitigation

CVE-2026-24376 is a Missing Authorization (Broken Access Control) vulnerability in the WPVulnerability WordPress plugin by Javier Casares. It affects all versions up to and including 4.2.1, allowing low-privileged authenticated attackers (Subscriber-level) to exploit incorrectly configured access control security levels. The vulnerability was reported on December 28, 2025, and published on March 18–25, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), where the plugin fails to perform adequate authorization checks on certain functions, allowing lower-privileged users to access or invoke functionality intended for higher-privileged roles. The attack vector is network-based, requires low privileges (Subscriber-level), no user interaction, and low attack complexity. An attacker with a basic WordPress account can send crafted requests to restricted plugin endpoints without proper capability checks being enforced (Patchstack).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact, meaning attackers can access sensitive information exposed by the plugin without authorization. Since WPVulnerability is a plugin designed to report on vulnerabilities in a WordPress installation, unauthorized access to its data could expose the site's vulnerability posture to attackers, facilitating targeted follow-on attacks. The scope is limited to the affected WordPress instance (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WPVulnerability plugin version ≤ 4.2.1 using tools like WPScan or Shodan, or by checking the plugin's readme.txt file accessible at /wp-content/plugins/wpvulnerability/readme.txt.
2. Obtain low-privileged access: Register or obtain a Subscriber-level account on the target WordPress site (many sites allow open registration).
3. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or admin endpoints registered by WPVulnerability that lack proper capability checks (e.g., via WordPress REST API or wp-admin/admin-ajax.php).
4. Send unauthorized request: Craft and send an authenticated HTTP request (with Subscriber-level nonce/cookie) to the restricted endpoint, bypassing the missing authorization check.
5. Access sensitive data: Retrieve vulnerability scan results or plugin/theme vulnerability data from the site's WPVulnerability reports, which can be used to identify further attack vectors on the target site (Patchstack).

• Logs: WordPress access logs showing Subscriber-level authenticated requests to WPVulnerability plugin endpoints (e.g., wp-admin/admin-ajax.php with plugin-specific actions) from unexpected IP addresses or at unusual times.
• Logs: Repeated or automated requests to plugin REST API routes or AJAX handlers associated with WPVulnerability from low-privileged user accounts.
• Network: Unusual outbound data transfers following authenticated requests to the plugin's endpoints, potentially indicating data exfiltration of vulnerability scan results.

The vendor has released version 4.2.1.1 which patches this vulnerability; all users should update the WPVulnerability plugin to version 4.2.1.1 or later immediately. As a temporary workaround for sites unable to update, Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for Patchstack users. Site administrators should also consider restricting user registration if not required, to limit the pool of potential attackers with Subscriber-level access (Patchstack).