OpenStation CVE-2026-109592

Exploitation requires two concrete preconditions stated in the description: (1) at least one orphaned placement must already exist - a state the plugin produces itself when its trash cascade marks a parent folder trashed while leaving child placements' parent_id intact; and (2) the attacker must first self-enable OpenStation by calling the save-openstation AJAX endpoint, which only needs the 'read' capability held by every default WordPress role. The attacker must be authenticated at subscriber level or above (PR:L); no user interaction is required. The practical limiting factor is the dependency on an orphaned-placement state existing, so sites with no orphaned placements are not exploitable until that condition arises.

This is a medium-severity authorization-bypass (CWE-862) issue whose signals are internally consistent and point to a real-but-non-urgent priority rather than an inflated high-CVSS alarm. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) indicates a network-reachable flaw requiring low-privileged authentication and no user interaction, with only a low integrity impact and no availability impact. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or automatable exploitation. No public exploit is identified in the input; the references are the Wordfence advisory and WordPress plugin source lines, not a weaponized PoC. One notable tension: the NVD-style vector sets C:N, yet the description explicitly states the attacker can 'read serialized metadata - including title, permalink, and post status' of referenced entities, which is a genuine (if minor) confidentiality disclosure - so the supplied vector appears to understate confidentiality impact. The flaw was also independently found by the OpenStation team, suggesting coordinated handling. Net: patch on a normal monthly cadence; it is a legitimate low-privilege broken-access-control bug, not a drop-everything emergency.

A low-privileged WordPress user (subscriber or above) authenticates, calls the save-openstation AJAX endpoint to self-enable OpenStation using only the default 'read' capability, then abuses the unauthorized action to tamper with other users' placement rows and read serialized metadata (title, permalink, post status) of the entities those orphaned placements reference. No public exploit is identified at time of analysis, and exploitation depends on at least one orphaned placement already existing.