CVE-2026-24990: 
WordPress vulnerability analysis and mitigation

CVE-2026-24990 is a Missing Authorization vulnerability in the WP Docs WordPress plugin developed by Fahad Mahmood. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels (CWE-862). The vulnerability affects WP Docs versions up to and including 2.2.8. It was published on February 3, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The root cause is a Missing Authorization flaw (CWE-862), where the WP Docs plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain actions. This is classified as a Broken Access Control vulnerability, meaning that low-privileged authenticated users can perform operations that should be restricted to higher-privilege roles. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit from any authenticated WordPress account (Feedly, Patchstack).

Successful exploitation results in limited integrity and availability impacts, with no confidentiality impact according to the CVSS scoring. An authenticated attacker with minimal privileges could perform unauthorized actions within the WP Docs plugin, such as modifying or deleting documentation content, potentially disrupting the availability of documentation resources on the affected WordPress site. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-24990. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. The CVE was assigned by Patchstack, which specializes in WordPress security research (Feedly, Patchstack).

WordPress site administrators should update the WP Docs plugin to a version beyond 2.2.8 if a patched release is available from the plugin developer or the WordPress plugin repository. Until a patch is confirmed, administrators should consider deactivating the plugin or restricting access to WordPress accounts to trusted users only. Monitoring WordPress user activity logs for unexpected actions related to the WP Docs plugin is also advisable (Patchstack).