CVE-2026-24627: 
WordPress vulnerability analysis and mitigation

CVE-2026-24627 is a Missing Authorization (Broken Access Control) vulnerability in the Trusona for WordPress plugin that allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. It affects all versions of the plugin up to and including 2.0.0, with no official patch currently available. The vulnerability was reported by researcher Legion Hunter on December 11, 2025, and published by Patchstack on January 10, 2026, with CVE assignment on January 23, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An authenticated attacker with Subscriber-level access can invoke functions that should be restricted to higher-privileged roles, exploiting the incorrectly configured access control. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation allows a low-privileged authenticated user to perform actions beyond their intended authorization level, resulting in a low integrity impact with no confidentiality or availability impact per the Patchstack CVSS assessment. The practical consequence is that a Subscriber-level WordPress user could manipulate plugin functionality or settings that should be restricted to administrators, potentially interfering with the Trusona authentication mechanism on the affected site. Given that Trusona is an authentication plugin, unauthorized manipulation of its settings could have downstream security implications for site login controls (Patchstack).

The vulnerability requires an authenticated session at Subscriber level or above, limiting opportunistic exploitation to attackers who can register or obtain a low-privilege account on the target WordPress site. Patchstack notes that vulnerabilities of this class are used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. The EPSS score is approximately 0.025% (0.000250), indicating a low probability of exploitation in the wild in the near term. No public proof-of-concept code, active in-the-wild exploitation, or CISA KEV catalog listing has been identified for this CVE (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Trusona for WordPress plugin version <= 2.0.0 using tools like WPScan or by checking the plugin version in publicly accessible readme.txt files.
2. Obtain low-privilege access: Register or log in as a Subscriber-level user on the target WordPress site (if open registration is enabled, or via compromised credentials).
3. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or REST API endpoints registered by the Trusona plugin that lack proper capability checks (e.g., wp_ajax_nopriv_ or wp_ajax_ hooks without current_user_can() validation).
4. Send unauthorized request: Craft and send an authenticated HTTP request (with a valid nonce or session cookie) to the identified endpoint, invoking a privileged action such as modifying plugin settings or authentication configurations.
5. Achieve unauthorized action: The server processes the request without verifying the user's role, allowing the attacker to alter Trusona plugin settings or perform other restricted operations (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the Trusona plugin from Subscriber-level user accounts; unexpected changes to Trusona plugin settings recorded in WordPress audit logs.
• File System: Unexpected modifications to Trusona plugin configuration files or WordPress options table entries related to the trusona plugin.
• Network: Repeated authenticated requests from the same low-privilege user account targeting Trusona-specific AJAX actions or plugin endpoints in a short time window.

As of the time of disclosure, no official patch is available for the Trusona for WordPress plugin, and the plugin appears to be unmaintained. Site administrators should consider deactivating and removing the Trusona for WordPress plugin until a patched version is released. As a compensating control, restrict WordPress user registration to prevent untrusted users from obtaining Subscriber-level accounts, and use a web application firewall (WAF) such as Patchstack to virtually patch the vulnerability (Patchstack).