Advanced Post Manager CVE-2026-111396

Exploitation requires an authenticated account on the target WordPress site (CVSS PR:L), so the realistic prerequisite is either open user registration or an attacker-controlled low-privileged account; the affected version range is Advanced Post Manager from n/a through 4.5.6. The limiting factor is that fully unauthenticated attackers cannot exploit this directly - some valid session is needed - which narrows exposure on sites that disable public registration and restrict account provisioning. The input description does not name the specific vulnerable endpoint, feature, or configuration setting, so the exact triggering action could not be extracted and should be read from the Patchstack advisory.

This is a moderate-priority issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, base 7.1) indicates a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L) and no user interaction, which for a WordPress plugin typically means any authenticated account (e.g., subscriber/contributor) can trigger it. The CWE-862 Missing Authorization root cause is consistent with a broken-access-control weakness reported by Patchstack. No EPSS score, CISA KEV listing, SSVC decision data, or POC was supplied, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. Note a conflict worth verifying: the input vector asserts A:H (high availability impact) with C:N/I:L, which is unusual for a generic missing-authorization flaw in a content-management plugin - a broken-access-control issue more commonly yields unauthorized data modification (integrity) than full availability loss, so the A:H rating should be verified against the Patchstack advisory. Because exploitation requires an authenticated (if low-privileged) account, real-world risk is meaningfully lower than an unauthenticated RCE despite the 7.1 score.

An attacker who holds a low-privileged authenticated account on a WordPress site running Advanced Post Manager ≤4.5.6 (for example a self-registered subscriber on a site with open registration) sends a request to a plugin endpoint that fails to verify the caller's authorization. Lacking the proper capability check, the plugin performs a restricted action on the attacker's behalf. No public exploit code was identified at time of analysis, and no user interaction is required.