EUVD-2026-41254
GHSA-rx4r-gfpx-w668
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor is a low-privilege authenticated role (PR:L), not high; no integrity or availability impact applies.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.
AnalysisAI
Broken access control in the Adminify WordPress plugin before 4.2.10 allows authenticated Contributor-level users to enumerate sensitive site data through an administration search feature that omits per-user read-capability checks. Affected data includes other authors' unpublished post titles, pending comment content, installed plugin inventory, and registered user account names - all information WordPress's native capability model would otherwise restrict. No public exploit has been identified at time of analysis, and a vendor-released patch is available at version 4.2.10.
Technical ContextAI
Adminify is a WordPress admin dashboard enhancement plugin. WordPress enforces a role-based capability system where low-privilege roles such as Contributor are restricted from reading draft content authored by others, viewing pending moderation queues, enumerating installed plugins, or listing user accounts. The vulnerability arises because Adminify's administration search feature queries these data sources server-side without verifying that the requesting user holds the appropriate WordPress capabilities (e.g., 'read_private_posts', 'list_users', 'activate_plugins'). This class of flaw is a missing authorization check - though no formal CWE has been assigned in the NVD entry, it aligns with CWE-862 (Missing Authorization). The affected version range per EUVD is Adminify versions 0 through below 4.2.10.
RemediationAI
The primary fix is to upgrade the Adminify WordPress plugin to version 4.2.10 or later, which introduces per-user capability checks on the administration search feature results. The patch is confirmed available per vendor advisory referenced at https://wpscan.com/vulnerability/0aa18fe0-2d64-45dc-9eab-9587d63853be/. If immediate upgrade is not possible, the most effective compensating control is to audit and remove Contributor-role accounts for any untrusted users, as exploitation requires an authenticated Contributor session. Alternatively, site administrators can restrict access to the WordPress admin dashboard (/wp-admin/) to known IP ranges, which raises the bar for an attacker to leverage a Contributor credential. Disabling the Adminify plugin entirely eliminates the vulnerable search feature at the cost of its administrative UI enhancements. Note that WordPress's built-in search does not carry this flaw - only Adminify's administration search endpoint is affected.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today