CVE-2026-24532: 
WordPress vulnerability analysis and mitigation

CVE-2026-24532 is a Missing Authorization (Broken Access Control) vulnerability in the SiteLock Security – WP Hardening, Login Security & Malware Scans WordPress plugin. It affects all versions through 5.0.2 and was reported by researcher Nabil Irawan on December 26, 2025, with public disclosure on January 23–25, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from insufficient authorization checks on one or more plugin functions, allowing incorrectly configured access control security levels to be exploited. An authenticated attacker with low privileges (e.g., Subscriber role) can invoke higher-privileged actions without proper authorization validation. No user interaction is required, and the attack is conducted over the network (Patchstack, NVD).

Successful exploitation allows a low-privileged authenticated user to perform unauthorized actions within the WordPress site, primarily affecting integrity (unauthorized modification of information). Confidentiality and availability impacts are assessed as none per the CVSS scoring. The practical risk is limited to unauthorized changes to plugin settings or security configurations managed by the SiteLock plugin (Patchstack).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack, NVD).

The vulnerability is patched in SiteLock Security plugin version 5.0.3. Site administrators should update the plugin to version 5.0.3 or later immediately via the WordPress admin dashboard or their hosting provider. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. As a general hardening measure, restrict WordPress user registrations and limit the number of accounts with Subscriber-level or higher access (Patchstack).

The vulnerability was discovered and reported by security researcher Nabil Irawan and disclosed through Patchstack's coordinated vulnerability disclosure process. Patchstack classified it as low priority with low severity impact, noting it is unlikely to be exploited in targeted attacks. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).