CVE-2026-24957: 
WordPress vulnerability analysis and mitigation

CVE-2026-24957 is a Missing Authorization (Broken Access Control) vulnerability in the WP Chill Strong Testimonials WordPress plugin. It affects all versions through 3.2.20 and allows authenticated attackers with low privileges (Contributor/Developer level) to exploit incorrectly configured access control security levels. The vulnerability was reported on November 28, 2025, by researcher Doan Dinh Van and published on February 3, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. An attacker with at least Contributor-level access can send crafted requests to trigger functionality that should be restricted to higher-privileged roles. No complex conditions or user interaction are required beyond having a low-privileged account on the affected WordPress site (Patchstack).

Successful exploitation primarily results in a high confidentiality impact, with no direct integrity or availability impact according to the CVSS scoring. An attacker with a low-privileged WordPress account could access or expose data or functionality beyond their intended authorization level. While the vendor classifies this as low priority with unlikely exploitation impact, broken access control vulnerabilities in WordPress plugins are commonly leveraged in mass-exploit campaigns targeting thousands of sites simultaneously (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.032% (0.000320), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority and notes it is unlikely to be exploited in a targeted manner, though mass-exploit campaigns against WordPress plugins remain a general risk (Patchstack).

The vulnerability is patched in Strong Testimonials version 3.2.21. Site administrators should update the plugin to version 3.2.21 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).