Ultimate Post Kit CVE-2026-105886

Exploitation requires an authenticated WordPress account on the target site at a low privilege level (CVSS PR:L - consistent with a self-registerable subscriber/contributor role), and the site must run Ultimate Post Kit version ≤4.5.5. The attacker then accesses a plugin function or endpoint that fails to verify the user's authorization. Limiting factors: exploitation is blocked on sites that disable open user registration or restrict low-privileged roles, and impact is confined to confidentiality (information disclosure) - no data modification or availability impact is indicated. No user interaction is required (UI:N).

This is a medium-severity (CVSS 6.5) Missing Authorization / Broken Access Control flaw (CWE-862) in the BdThemes Ultimate Post Kit WordPress plugin. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable issue with low attack complexity that nonetheless requires some authenticated privilege (PR:L) - typically a low-privileged account such as subscriber or contributor on a WordPress site. Impact is confidentiality-only (C:H, I:N, A:N), meaning the flaw most plausibly exposes data/content an attacker should not be able to read rather than allowing modification or disruption. There is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the supplied data, so this is not currently a widespread-exploitation emergency. Net assessment: a legitimate patch-management priority for sites running the affected plugin because exploitation is low-complexity for any registered user, but it is NOT a drop-everything critical given the authentication requirement, confidentiality-only impact, and absence of exploitation signals. Note a terminology conflict in the input: the 'Authentication Bypass' tag is inconsistent with CWE-862 and the description, which describe missing authorization (an authenticated-but-under-privileged user accessing restricted functionality), not an authentication bypass - verify the precise behavior with the Patchstack advisory.

An attacker registers or already holds a low-privileged account (e.g., subscriber) on a WordPress site running Ultimate Post Kit ≤4.5.5 and sends a request to a plugin endpoint that fails to enforce proper authorization checks, retrieving content or data restricted to higher-privileged roles. No public proof-of-concept is identified in the provided data, and the low attack complexity means exploitation requires only a valid session and a crafted request.