Pricing Table WordPress Plugin CVE-2026-111947

Requires an authenticated WordPress account with the contributor role or higher on a site running the Pricing Table WordPress Plugin before 4.1.3, and use of the plugin's LEGACY pricing-table duplication feature, which fails to perform authorization checks. Limiting factors: the attacker must already have a valid low-privilege account (contributor+), so fully anonymous exploitation is not possible; impact is confined to cloning/publishing existing posts and pages (including other users' private and draft content) rather than full site compromise. The 'legacy' qualifier implies the duplication path affected may depend on the plugin being used in a mode that still exposes legacy pricing tables.

This is a moderate-severity WordPress plugin authorization flaw (CWE-639, IDOR) that is a real but not urgent priority. Signals are mixed: a public exploit exists (reported by WPScan, with published vulnerability detail) and a patch is available, yet there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or active exploitation - consistent with a low-glamour access-control bug rather than a mass-exploited RCE. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N = 5.5) contains a notable internal conflict: it specifies PR:H (high privileges), but the description states exploitation requires only the 'contributor role and above,' which in WordPress is a LOW-privilege authenticated role - this suggests the true privilege requirement is PR:L and that the realistic severity is somewhat higher than 5.5 (closer to ~7.1). This discrepancy should be verified against the WPScan advisory. No SSVC decision data, KEV, or EPSS was supplied, so automatability and exploitation-maturity signals cannot be cross-referenced. Net: a credible, low-barrier authenticated disclosure/clone issue worth prompt patching on affected sites, but not a drop-everything emergency absent active-exploitation evidence.

An attacker who holds (or registers/obtains) a WordPress contributor account on a vulnerable site invokes the plugin's legacy pricing-table duplication function, which skips authorization checks. By referencing the ID of a post or page they do not own, they clone and publish other users' private or draft content - exposing unpublished or confidential material. A public exploit/vulnerability writeup from WPScan exists, lowering the effort required.