CVE-2026-4326: 
WordPress vulnerability analysis and mitigation

CVE-2026-4326 is a Missing Authorization vulnerability in the Vertex Addons for Elementor WordPress plugin (by Webilia) affecting all versions up to and including 1.6.4. The flaw allows authenticated attackers with Subscriber-level access or above to install and activate arbitrary plugins from the WordPress plugin repository. It was published on April 9, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), assigned by Wordfence (GitHub Advisory, Wordfence).

The root cause is a broken authorization check (CWE-862: Missing Authorization) in the activate_required_plugins() function within app/Ajax.php. The current_user_can('install_plugins') capability check is implemented incorrectly: when the check fails, it only sets an error message variable rather than halting execution. The plugin installation and activation code continues to run, and the error response is only sent after the operation has already completed. This logic flaw means any authenticated user — regardless of their actual privilege level — can trigger plugin installation via a crafted AJAX request (GitHub Advisory, WordPress Trac).

Successful exploitation allows low-privileged authenticated attackers (Subscriber-level and above) to install and activate arbitrary plugins from the WordPress plugin repository, effectively granting them the ability to introduce malicious code into the WordPress installation. This can lead to full site compromise, including theft of sensitive data (confidentiality impact: High), unauthorized modification of site content or configuration (integrity impact: High), and disruption of site availability (availability impact: High). Attackers could leverage this to establish persistent backdoor access or pivot to further attacks on the hosting environment (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.084%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the low privilege requirement (Subscriber-level) and network-accessible attack vector make this relatively easy to exploit if an attacker has any valid WordPress account on a vulnerable site.

1. Reconnaissance: Identify WordPress sites running the Vertex Addons for Elementor plugin (version ≤ 1.6.4) using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Obtain low-privilege credentials: Register or obtain a Subscriber-level (or higher) account on the target WordPress site — many sites allow open registration.
3. Craft a malicious AJAX request: Authenticate to the WordPress site and send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the activate_required_plugins() function handler, specifying the desired plugin slug from the WordPress plugin repository.
4. Bypass authorization: Because the capability check in Ajax.php (around lines 229–278) does not terminate execution on failure, the server proceeds to install and activate the specified plugin despite the attacker lacking install_plugins capability.
5. Activate a malicious or vulnerable plugin: Install a known-vulnerable or attacker-controlled plugin that provides a web shell, remote code execution, or administrative backdoor, achieving persistent access to the WordPress site (GitHub Advisory, WordPress Trac).

• Network: Unexpected HTTP POST requests to /wp-admin/admin-ajax.php from low-privilege user sessions with parameters referencing plugin installation or activation actions associated with the Vertex Addons for Elementor plugin.
• Logs: WordPress access logs showing AJAX requests to plugin activation endpoints from Subscriber-level accounts; WordPress debug logs recording plugin installation events not initiated by an administrator.
• File System: Presence of newly installed plugins in the /wp-content/plugins/ directory that were not authorized by an administrator; unexpected PHP files or web shells within plugin directories.
• WordPress Admin: Plugin list showing recently activated plugins not recognized by site administrators; new administrator accounts or modified user roles created after plugin activation.

Update the Vertex Addons for Elementor plugin to a version newer than 1.6.4, which contains the corrected authorization logic in activate_required_plugins(). A patch changeset is available via the WordPress plugin repository (WordPress Trac Changeset). As interim mitigations: restrict or disable open user registration on the WordPress site, audit and remove unnecessary Subscriber-level accounts, and monitor plugin installation logs for unauthorized activity. If an immediate update is not possible, consider deactivating the plugin until a patched version can be applied (GitHub Advisory, Wordfence).

Wordfence, which assigned the CVE, included this vulnerability in their weekly WordPress vulnerability report for April 6–12, 2026, highlighting the missing authorization flaw as a notable risk for sites with open user registration (Wordfence Blog). Security aggregators including RedPacket Security and InfinitSec covered the disclosure shortly after publication. No significant social media controversy or broader industry debate has been observed beyond standard vulnerability notification channels.