WebberZone Knowledge Base CVE-2026-108499

Exploitation requires that the target WordPress site runs the WebberZone Knowledge Base plugin at version 3.2.0 or earlier. The description attributes the issue to 'Incorrectly Configured Access Control Security Levels,' indicating the exposure centers on the plugin's access-control/visibility settings for knowledge base content; sites that do not rely on the plugin's restricted-content features may have little of value to expose. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required to reach the vulnerable endpoint, so the primary limiting factors are presence of the vulnerable plugin version and whether any content was actually configured as access-restricted; impact is bounded to confidentiality (C:L) with no write or availability consequences.

This is a moderate-severity Missing Authorization flaw (CWE-862, CVSS 5.3) in the WebberZone Knowledge Base WordPress plugin, reported by Patchstack. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation with no user interaction, which on its face sounds easy to exploit. However, impact is deliberately narrow: only C:L (limited confidentiality) with no integrity or availability impact (I:N/A:N) and unchanged scope (S:U), meaning the realistic outcome is unauthorized read access to knowledge base content that should have been access-controlled, not account takeover or code execution. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit code referenced, so there is no evidence of active or imminent widespread exploitation. No SSVC decision data was supplied. Net assessment: this is a genuine but low-priority information-disclosure issue rather than a critical threat - the 'unauthenticated + network' signals are offset by the confidentiality-only, low-magnitude impact and the niche deployment footprint. Note a minor tension to verify: the description frames the issue as 'Incorrectly Configured Access Control Security Levels,' which may imply the flaw only manifests under certain plugin access-control configurations, whereas the CVSS PR:N implies default unauthenticated reach - confirm with the Patchstack advisory whether default installs are affected.

An unauthenticated remote attacker sends a direct HTTP request to a Knowledge Base plugin endpoint or article resource that lacks a proper authorization check, retrieving knowledge base entries intended to be restricted. Because CVSS is AV:N/AC:L/PR:N/UI:N, no credentials, special timing, or victim interaction are needed, though the realistic payoff is limited to disclosure of protected content (C:L, no integrity/availability impact). No public proof-of-concept exploit was identified in the provided data.