CVE-2026-24570: 
WordPress vulnerability analysis and mitigation

CVE-2026-24570 is a Missing Authorization (Broken Access Control) vulnerability in the WisdmLabs Edwiser Bridge WordPress plugin. It affects all versions up to and including 4.3.2, and was reported by researcher Nabil Irawan on December 22, 2025, with public disclosure on January 21–23, 2026. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more functions within the plugin fail to properly verify whether the requesting user has the necessary permissions before executing privileged actions. An authenticated attacker with low-level privileges (e.g., Subscriber role) can exploit this over the network without user interaction, triggering actions that should be restricted to higher-privileged users. The root cause is an absent or incorrectly configured authorization or nonce token check in a plugin function (Patchstack).

Successful exploitation allows a low-privileged authenticated user to perform actions beyond their intended access level, resulting in limited integrity and availability impacts on the affected WordPress site. Confidentiality impact is assessed as none, meaning sensitive data exposure is not a primary concern. The vulnerability could be leveraged to disrupt plugin functionality or manipulate data managed by the Edwiser Bridge plugin, which handles Moodle-WordPress integration including course and user management (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Edwiser Bridge plugin version 4.3.2 or earlier using tools like WPScan or Shodan, or by checking the plugin's readme.txt file exposed at /wp-content/plugins/edwiser-bridge/readme.txt.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged account (e.g., Subscriber) on the target WordPress site, as the vulnerability requires authentication at this level.
3. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or REST API endpoints registered by Edwiser Bridge that lack proper capability checks, using browser developer tools or by reviewing plugin source code.
4. Send unauthorized request: Craft and send an HTTP request (e.g., a POST to wp-admin/admin-ajax.php with the relevant action parameter) to invoke a privileged function without the required authorization check.
5. Achieve unauthorized action: The server processes the request without validating the user's role, allowing the attacker to perform restricted operations such as modifying course enrollments, user data, or plugin settings (Patchstack).

• Logs: WordPress access logs showing repeated POST requests to wp-admin/admin-ajax.php with Edwiser Bridge-specific action parameters from low-privileged user accounts; unexpected administrative actions attributed to Subscriber-level users in WordPress audit logs.
• Application: Unexpected changes to Moodle course enrollments, user synchronization records, or Edwiser Bridge plugin settings not initiated by an administrator.
• Network: Unusual authenticated HTTP POST traffic to WordPress AJAX or REST endpoints from unfamiliar IP addresses associated with low-privileged accounts.

The vendor has released version 4.3.3 of the Edwiser Bridge plugin, which patches this vulnerability. Site administrators should update the plugin to version 4.3.3 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level account creation can reduce the attack surface (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher Nabil Irawan, classifies it as low priority with unlikely exploitation impact. No notable vendor statements beyond the patch release or significant community/media coverage has been identified for this vulnerability.