zportals CVE-2026-18364

Requires a valid authenticated subscriber-level (or higher) WordPress account, so the target site must permit user registration or the attacker must otherwise obtain low-privilege credentials - this is the key limiting factor. The vulnerable zportals plugin must be installed and running a version before 6.4.2. Exploitation targets the plugin's AJAX action handlers (via admin-ajax.php) that omit both capability and nonce checks; no additional non-default configuration is stated as required. Impact is limited to modifying the plugin's stored integration settings.

This is a genuine but low-severity broken-access-control issue, correctly scored by WPScan at CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The vector is network-reachable with low complexity, but exploitation requires an authenticated subscriber-level account (PR:L), and impact is integrity-only and limited (I:L) - an attacker can modify the plugin's stored integration settings but cannot directly read data (C:N) or cause outages (A:N). CWE-862 (missing authorization) is the accurate root cause: several AJAX actions lack both capability and nonce checks. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is 'no public exploit identified at time of analysis' rather than an actively-exploited priority. The real-world risk is modest: it matters only on sites that (a) allow open/subscriber registration and (b) run the zportals plugin, and even then the immediate impact is tampering with integration configuration rather than site takeover. Note the 'Authentication Bypass' tag is imprecise - this is a missing-authorization (privilege escalation within an authenticated context) flaw, not a true authentication bypass. Secondary risk depends on what those 'integration settings' control (e.g., third-party API endpoints/keys), which could enable follow-on abuse, but the CVSS I:L reflects that this is not confirmed to reach confidentiality or availability impact.

On a WordPress site with open registration and the zportals plugin (<6.4.2) installed, an attacker registers a normal subscriber account and logs in. They then send a crafted admin-ajax.php request to one of the unprotected zportals AJAX actions - no nonce or capability is enforced - overwriting the plugin's stored integration settings. No public POC is referenced in the provided data.