CVE-2026-28071: 
WordPress vulnerability analysis and mitigation

CVE-2026-28071 is a Missing Authorization (Broken Access Control) vulnerability in the PixFort pixfort Core WordPress plugin. It affects all versions up to and including 3.2.22, allowing low-privileged authenticated users to exploit incorrectly configured access control security levels. The vulnerability was published on March 2–5, 2026, and was discovered by researcher Rafie Muhammad and reported through Patchstack's Active VDP program. It carries a CVSS v3.1 base score of 6.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. An authenticated attacker with Subscriber-level access can send crafted requests to trigger functionality intended for higher-privileged roles, exploiting the incorrectly configured access control checks. No authentication bypass is required — only a low-privilege account is needed, and no user interaction is necessary, making the attack vector straightforward over the network (Patchstack).

Successful exploitation results in low-level impacts across confidentiality, integrity, and availability, as reflected in the CVSS scoring. An attacker with a subscriber-level WordPress account could perform unauthorized privileged actions within the plugin, potentially modifying plugin-controlled content or settings, accessing restricted data, or disrupting plugin functionality. While the scope is unchanged and the individual impact per dimension is rated low, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as medium priority and warns it is expected to be exploited in mass-exploit campaigns, consistent with the pattern seen for broken access control issues in popular WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the pixfort Core plugin version 3.2.22 or earlier using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Account acquisition: Register or obtain a low-privilege WordPress account (e.g., Subscriber role) on the target site, which may be possible if the site allows open registration.
3. Identify vulnerable endpoints: Enumerate plugin-specific AJAX actions or REST API endpoints registered by pixfort Core that lack proper capability checks, using tools like Burp Suite or manual code review of the plugin source.
4. Craft unauthorized request: Send an authenticated HTTP request (with valid nonce/session cookie for the subscriber account) to the identified privileged endpoint, bypassing the missing authorization check.
5. Execute privileged action: Achieve the unauthorized action — such as modifying plugin settings, accessing restricted content, or triggering administrative functions — without holding the required role (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the pixfort Core plugin from low-privilege user accounts at unusual times or frequencies.
• Logs: WordPress debug or error logs showing unexpected capability checks or authorization failures related to pixfort Core plugin functions.
• Network: Repeated authenticated requests to pixfort Core plugin endpoints from the same IP or user account in a short time window, indicative of automated scanning or exploitation.
• File System: Unexpected changes to plugin configuration files or WordPress options table entries associated with pixfort Core settings following subscriber-level user activity.

The vendor has released a patched version: update the pixfort Core plugin to version 3.2.26 or later to resolve the vulnerability. Site administrators who cannot immediately update should consider temporarily disabling the plugin or restricting user registration to prevent untrusted users from obtaining subscriber-level accounts. Patchstack users benefit from an automatically deployed virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated (Patchstack).

The vulnerability was discovered by security researcher Rafie Muhammad and responsibly disclosed through Patchstack's Active Vulnerability Disclosure Program (VDP), with the report submitted on September 12, 2025, and published on March 2, 2026. Patchstack highlighted the risk of mass-exploit campaigns targeting this class of vulnerability in WordPress plugins. No significant broader media coverage or notable social media commentary beyond standard vulnerability database entries has been identified (Patchstack).