EUVD-2026-86539
GHSA-3f7w-g6wh-fmwv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WP user
-
ExploitToggle own ai.enabled via POST /desktop-mode/v1/os-settings
-
ExecutionQuery AI-copilot search endpoints
-
ImpactRead private/draft post data and spam comment content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account on a site running the OpenStation (Desktop Windows, Dock & Virtual Desktops for WP Admin) plugin version 1.1.7 or earlier. The intended prerequisite is 'custom-level access and above' plus an enabled AI feature (ai.enabled), but this barrier is effectively removed because any user with the default 'read' capability can self-enable ai.enabled by toggling it at the /openstation/ portal via the POST /desktop-mode/v1/os-settings endpoint. Limiting factors: an attacker must hold a valid account (no unauthenticated path), and the exposure is read-only over post metadata/excerpts and unapproved/spam comment content - no write, no full post body beyond a 300-character excerpt. |
| Impact | This is a genuinely low-priority, low-severity issue despite being an authorization bypass. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) accurately reflects the scope: network-reachable but requiring an authenticated account (PR:L), with only limited confidentiality impact (C:L) and no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The one aggravating factor is that the description documents a privilege-escalation-of-access twist: any authenticated user holding the baseline 'read' capability can self-enable the gating 'ai.enabled' setting via POST /desktop-mode/v1/os-settings, collapsing the intended 'custom-level access and above' barrier down to essentially any logged-in user - this makes real-world exploitability easier than the PR:L metric implies, but the impact ceiling remains an information leak of draft/private post metadata and unapproved comment content, not code execution or data modification. Net assessment: real but minor; a patch-hygiene item, not an emergency. All signals (low CVSS, no KEV, no EPSS, no POC) are consistent with each other. |
| Exploit ScenarioDerived | An attacker registers or already holds any low-privilege WordPress account on a site running OpenStation <=1.1.7. They visit the /openstation/ portal and toggle their own ai.enabled setting on, then query the AI-copilot search endpoints to read titles, statuses, permalinks, and 300-character excerpts of other authors' private, draft, pending, or scheduled posts, plus the content and AI-moderation verdicts of unapproved and spam comments. No public exploit code was identified, but the attack requires only ordinary authenticated web requests and no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Authorization bypass in the OpenStation - Desktop Windows, Dock & Virtual Desktops for WP Admin WordPress plugin (slug desktop-mode) through version 1.1.7 lets any authenticated user - even one holding only the default 'read' capability that every Subscriber gets - read the title, status, date, permalink and a 300-character content excerpt of private, draft, pending and future posts, as well as the body and AI-moderation verdicts of unapproved and spam comments. The intended 'custom-level access plus enabled AI feature' prerequisite collapses because any logged-in user can self-enable ai.enabled by posting to /desktop-mode/v1/os-settings from the /openstation/ portal. It is a read-only confidentiality leak with no write or code-execution impact, no public exploit identified at time of analysis, and no CISA KEV or EPSS signal, which is consistent with the genuinely low-priority assessment.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the vendor repository shows changeset r3692599 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3692599%40desktop-mode&new=3692599%40desktop-mode), which should be treated as the fixing commit for this authorization gap, but no tagged release number beyond the affected 1.1.7 is confirmed in the provided data. Until a patched build from the plugin's official update channel can be verified against the changeset, the safest immediate action is to deactivate and remove the OpenStation plugin if its admin-desktop feature is not business-critical; the trade-off is loss of the desktop/dock UI for administrators, which is preferable to leaving private and draft content readable. If the plugin must stay active, restrict the attack surface at the web tier by blocking requests to the /desktop-mode/v1/* REST namespace (including /desktop-mode/v1/os-settings) with a reverse-proxy/WAF rule or by hooking rest_authentication_errors to reject that namespace for non-administrator roles - this stops both the self-enabling of ai.enabled and the follow-on metadata reads, at the cost of breaking the plugin's REST-driven features for legitimate users. Disabling the AI copilot feature site-wide (including ai.enabled defaults) removes the most direct data-exposure path while leaving the desktop UI partly functional. Because exploitation requires a valid low-privilege account, also review user registrations: disable open self-registration and audit existing Subscriber-level accounts on sites where untrusted users were allowed to sign up, since the default 'read' capability is all an attacker needs. Monitor web logs for POSTs to /desktop-mode/v1/os-settings and subsequent calls to AI-copilot search endpoints as a detection signal for attempted abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): the plugin's REST namespace /desktop-mode/v1 and its AI-copilot search routines in includes/ai-copilot/search.php (referenced at lines 628, 1244, 1851 and 1945 of the 1.0.1 tag) build queries over wp_posts and the comments table and return results without checking that the calling user holds the capabilities needed to view non-public content (for example edit_others_posts / moderate_comments rather than the baseline 'read' capability). WordPress exposes these queries through the REST API, so the check must be enforced server-side per request; here it is absent or tied to a feature flag (ai.enabled) rather than to a capability. The secondary flaw is that the same flag is user-writable: the os-settings endpoint accepts an ai.enabled toggle from any authenticated session, so a Subscriber can grant themselves the 'prerequisite' that was supposed to gate the feature. The affected component is the WordPress plugin distributed under the slug desktop-mode and identified by CPE cpe:2.3:a:allterraindeveloper:openstation:_desktop_windows,_dock_&_virtual_desktops_for_wp_admin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N matches this reading exactly: network-reachable, low privileges required, no user interaction, confidentiality-only with low impact and no integrity or availability effect.
Know when Openstation gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable but requires any authenticated account (PR:L); read-only leak of limited post metadata and comment content gives C:L with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The OpenStation - Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam comments. Any authenticated user with the 'read' capability can self-enable the required AI feature by visiting the /openstation/ portal and toggling their own ai.enabled setting via the POST /desktop-mode/v1/os-settings endpoint, removing any practical barrier to exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB