CVE-2026-24534: 
WordPress vulnerability analysis and mitigation

CVE-2026-24534 is a Missing Authorization (Broken Access Control) vulnerability in the uPress Booter (booter-bots-crawlers-manager) WordPress plugin. It affects all versions through 1.5.7 and was disclosed on January 23, 2026, by Patchstack, with credit to researcher Nabil Irawan who reported it on December 26, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before executing certain privileged actions. A low-privileged user (e.g., a WordPress Subscriber role) can exploit this over the network without any user interaction, effectively bypassing access control restrictions. This falls under OWASP Top 10 category A1: Broken Access Control. No public technical write-up or proof-of-concept code detailing the specific vulnerable function has been published (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions within the WordPress plugin, resulting in a limited integrity impact (unauthorized data modification). Confidentiality and availability are not directly impacted per the Patchstack CVSS assessment (C:N/I:L/A:N). The practical risk is constrained to WordPress sites running the vulnerable plugin where attackers already hold at least Subscriber-level accounts (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vulnerability is patched in Booter plugin version 1.5.8. Site administrators should update the uPress Booter plugin to version 1.5.8 or later immediately. If an immediate update is not possible, consider disabling the plugin until patching can be performed, or contact your hosting provider for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).