Falcon WordPress Plugin CVE-2026-112826

The target site must be running the Falcon - WordPress Optimizations & Tweaks plugin at version 2.12.0 or earlier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special attack complexity is required, so any exposed WordPress install with the vulnerable plugin is reachable over the network. The description attributes the flaw to 'Incorrectly Configured Access Control Security Levels,' indicating the missing authorization check is in the plugin code path itself rather than a non-default setting; the primary limiting factor is simply having this specific plugin installed and the capped LOW confidentiality-only impact, which bounds what an attacker can obtain to restricted information exposure rather than site takeover.

This is a moderate-severity Missing Authorization issue (CWE-862) in the Falcon WordPress plugin, rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - meaning remote, low-complexity, unauthenticated access with only a LOW confidentiality impact and no integrity or availability impact. The low single-impact profile is why the score sits at 5.3 rather than higher, and it indicates information exposure or access to a function that should be restricted, not full compromise. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced in the input, so there is no public exploit identified at time of analysis. The sole source is a Patchstack advisory (reporter audit@patchstack.com), which is a credible WordPress-focused research source but represents a single-vendor datapoint. On balance this is a real but lower-priority issue: the unauthenticated network vector means it is trivially reachable, yet the capped LOW confidentiality impact and absence of any exploitation signals (no KEV, no POC, no EPSS) argue against treating it as an urgent, actively-exploited threat. Prioritize patching in routine cycles rather than as an emergency.

An unauthenticated remote attacker sends a crafted HTTP request directly to a Falcon plugin endpoint or AJAX action that lacks a proper capability/authorization check, causing the plugin to disclose restricted information or perform a restricted read action without verifying the caller's privileges. No public exploit code is referenced, and the CVSS vector confirms no user interaction or authentication is required (AV:N/PR:N/UI:N), though impact is limited to confidentiality (C:L).