CVE-2026-24950: 
WordPress vulnerability analysis and mitigation

CVE-2026-24950 is an Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key vulnerability in the WordPress plugin Authorsy by themeplugs. It affects all versions up to and including 1.0.6, allowing unauthenticated remote attackers to bypass access controls and access sensitive data. The vulnerability was reported by researcher NumeX on November 18, 2025, and published on February 20, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack, Feedly).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a form of IDOR where the plugin fails to properly validate that a requesting user is authorized to access the object identified by a user-supplied key or identifier. Because no authentication or privilege is required, an attacker can manipulate object references in HTTP requests to access resources or data they should not be permitted to view. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit at scale (Patchstack, Feedly).

Successful exploitation results in a high confidentiality impact — unauthenticated attackers can bypass authorization controls to access sensitive files, folders, or database records managed by the Authorsy plugin. Integrity and availability are not directly impacted by this vulnerability. Given that no authentication is required, the vulnerability is well-suited for mass-exploit campaigns targeting large numbers of WordPress sites simultaneously, regardless of their traffic or popularity (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.032% (0.000320), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that IDOR vulnerabilities of this type are commonly used in mass-exploit campaigns against WordPress sites (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the Authorsy plugin version ≤ 1.0.6 using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/authorsy).
2. Identify object references: Browse the target site to observe how the Authorsy plugin references objects (e.g., author IDs, post IDs, or other resource identifiers) in HTTP requests or API endpoints.
3. Manipulate the key: Craft HTTP requests that substitute or enumerate different object reference values (e.g., incrementing numeric IDs or substituting known identifiers) without providing authentication credentials.
4. Access unauthorized data: Submit the manipulated requests to the vulnerable endpoint; due to missing server-side authorization checks, the plugin returns data belonging to other users or restricted resources.
5. Exfiltrate sensitive information: Collect the returned sensitive data (e.g., author details, private content, or database records) for further use or lateral movement within the WordPress environment (Patchstack).

• Network: Unusual unauthenticated HTTP GET/POST requests to Authorsy plugin endpoints with enumerated or manipulated object reference parameters (e.g., sequential numeric IDs); high volume of requests to plugin-specific URLs from a single IP.
• Logs: WordPress access logs (access.log) showing repeated requests to /wp-content/plugins/authorsy/ or associated REST API routes with varying ID parameters and no authentication headers; HTTP 200 responses to requests that should require authentication.
• File System: No direct file system artifacts expected for a read-only IDOR; however, monitor for unexpected file access patterns in WordPress directories if exploitation escalates.
• Process: No unusual process behavior expected for a pure IDOR; monitor for follow-on activity such as admin account creation or plugin/theme modifications that may indicate chained exploitation (Patchstack).

The vendor has released a patched version: Authorsy 1.0.7, which resolves the vulnerability. Site administrators should update the Authorsy plugin to version 1.0.7 or later immediately. If an immediate update is not possible, Patchstack has issued a virtual patching/mitigation rule for its users to block exploitation attempts until the plugin is updated. Contacting your hosting provider or web developer for assistance is recommended if self-updating is not feasible (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report for the period of February 2–8, 2026, highlighting it among notable plugin vulnerabilities. Coverage has been largely limited to automated vulnerability aggregators and security intelligence feeds, with no significant independent researcher commentary or broad media coverage identified (Wordfence Blog).