CVE-2026-28104: 
WordPress vulnerability analysis and mitigation

CVE-2026-28104 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin "Site Suggest" by Aryan Shirani Bid Abadi. It allows unauthenticated remote attackers to access functionality not properly constrained by access control lists (ACLs). All versions up to and including 1.3.9 are affected, and no official patch is currently available. The vulnerability was reported by Legion Hunter on August 29, 2025, disclosed publicly on February 26, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, NVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requesting user has the appropriate permissions before executing certain privileged actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The specific functionality exposed without proper ACL enforcement has not been detailed in public write-ups, but the vulnerability class typically involves unprotected AJAX handlers or REST API endpoints in WordPress plugins (Patchstack, NVD).

Successful exploitation allows an unauthenticated attacker to perform actions with integrity and availability impact on the affected WordPress site. Specifically, the CVSS scoring reflects low integrity impact (I:L) and low availability impact (A:L) with no confidentiality impact, meaning attackers may be able to modify or disrupt certain site functionality but are not expected to exfiltrate sensitive data through this vulnerability alone. The scope is limited to the affected WordPress installation, though it could be chained with other vulnerabilities for broader compromise (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity (Patchstack).

No official patch from the plugin developer is currently available for versions up to and including 1.3.9. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators are advised to deactivate and remove the Site Suggest plugin until a patched version is available, or to use a web application firewall (WAF) solution such as Patchstack to mitigate the risk (Patchstack).

The vulnerability was discovered and reported through Patchstack's Active Vulnerability Disclosure Program (VDP) by researcher Legion Hunter. Patchstack classified it as medium priority and noted the risk of mass-exploit campaigns targeting this class of vulnerability. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).