FlexTable CVE-2026-24582

Exploitation requires a valid WordPress user account with at minimum subscriber-level privileges on the target installation - unauthenticated exploitation is not possible per the CVSS PR:L (low-privilege required) vector. The target site must be running FlexTable plugin version 3.24.0 or earlier. The specific plugin endpoint or feature subject to the missing authorization check is not disclosed in available public data. The attack is not automatable per SSVC, indicating it requires deliberate manual interaction rather than scripted mass targeting. Exploitation is further constrained to environments where an attacker can obtain a low-privilege account, either through open user registration, credential theft, or social engineering - sites that disable public registration and restrict account creation to administrators significantly reduce realistic attack surface.

The CVSS 4.3 (Medium) score reflects a network-accessible attack path requiring low privilege (PR:L), low complexity (AC:L), no user interaction, with impact confined to limited integrity modification (I:L) and no confidentiality or availability breach (C:N/A:N). The SSVC assessment independently corroborates a low-urgency posture: exploitation status is none, the attack is not automatable, and technical impact is only partial. EPSS at 0.03% (8th percentile) places this in the lowest tier of exploitation probability. The 'Authentication Bypass' tag attached to this CVE should not be interpreted as unauthenticated access - the CVSS PR:L vector confirms a low-privilege account is required, and the tag refers to bypassing authorization checks rather than bypassing authentication itself; these are distinct concepts. Collectively, the signals indicate this is a real but low-urgency vulnerability best addressed through routine patch management rather than emergency response. No conflicting signals between data sources were identified.

An attacker with a low-privilege WordPress account (e.g., a registered subscriber on a site with open user registration) sends a crafted authenticated request directly to a FlexTable AJAX or REST endpoint that lacks a capability check. The request triggers a restricted plugin operation - such as modifying table sync configuration or altering table data - that should require editor or administrator privileges. No public proof-of-concept code exists at time of analysis, though broken access control vulnerabilities of this class in WordPress plugins are straightforward to discover and exploit manually once an account is obtained.