EUVD-2026-91660
GHSA-p74r-g37c-933q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryIdentify unprotected plugin action
-
ExploitSend request bypassing authorization check
-
ExecutionPerform unauthorized state-changing action
-
ImpactIntegrity compromise of site data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with at least a low-privilege WordPress account (PR:L), because the flaw is a missing authorization/capability check on a WebSamurai plugin action rather than a pre-authentication bypass. The site must be running WebSamurai version n/a through 1.0.7. No user interaction is needed and attack complexity is low, but the requirement for a valid low-level account on the target site is the key limiting factor, meaningfully reducing exposure on sites that do not allow untrusted user registration. Impact is limited to integrity (C:N/A:N), so no data disclosure or denial of service results directly. |
| Impact | This is a moderate-severity Broken Access Control / Missing Authorization flaw (CWE-862) in the WebSamurai WordPress plugin, scored CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The vector indicates a network-reachable, low-complexity attack requiring low privileges (PR:L - i.e. an authenticated low-level account such as a subscriber or contributor) and no user interaction, yielding a high integrity impact with no confidentiality or availability impact. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag conflicts somewhat with the CVSS PR:L metric, which indicates an authenticated attacker escalating via missing authorization rather than a true pre-auth bypass - treat the tag as loose labeling and rely on PR:L. Overall this is a real but not urgent issue: typical of the large volume of Patchstack-reported WordPress plugin access-control bugs, its priority is driven mainly by how widely the specific plugin is deployed, which appears to be very low. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged authenticated account on a WordPress site running WebSamurai (≤1.0.7) sends a crafted request to a plugin endpoint that fails to verify the caller's authorization level. Because the capability/authorization check is missing, the attacker performs actions or modifies data they should not be permitted to, resulting in unauthorized integrity changes. No public exploit code is referenced, and exploitation requires an existing low-level account and low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Missing authorization in the WebSamurai WordPress plugin (versions up to and including 1.0.7) lets an attacker who already holds a low-privilege authenticated account on the target site invoke a plugin action that lacks a proper capability check, altering site data without permission. Because the CVSS vector is PR:L, exploitation requires a valid low-privilege WordPress session rather than being unauthenticated, and the assessed impact is integrity-only (C:N/I:H/A:N) with no disclosure or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, so real-world exposure is concentrated on sites that permit untrusted user registration or otherwise host low-trust accounts.
RemediationAI
No fixed version is listed in the available intelligence, so a vendor patch cannot be cited with confidence; the referenced Patchstack advisory should be checked for a newly released patched version of WebSamurai and the plugin updated as soon as one is published. Until then, the most effective control is to deactivate the WebSamurai plugin if it is not business-critical (trade-off: loss of its functionality). If it must remain active, restrict who can hold accounts on the site by disabling open/untrusted user registration and reverting any self-service signup, audit and downgrade existing low-privilege accounts, and remove unused Subscriber/Contributor users, since PR:L is the sole prerequisite for exploitation. Also apply the principle of least privilege to roles, monitor plugin-related AJAX/REST requests and post-change activity for unexpected writes, and consider a WAF rule blocking unauthenticated or low-privilege calls to the plugin's action endpoints - noting that WAF coverage is partial and cannot replace a proper capability check.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-862 (Missing Authorization) in a WordPress plugin, which means an AJAX action, REST route, or admin-post handler registered by WebSamurai performs a state-changing operation without calling current_user_can() or an equivalent capability/nonce check. WordPress plugins typically expose such endpoints through admin-ajax.php or the REST API, and a missing authorization check means any logged-in user - including a Subscriber with only read-level capabilities - can reach code intended for higher-privileged roles. The CPE entry cpe:2.3:a:kiera_howe:websamurai:*:*:*:*:*:*:*:* confirms the affected component is the WebSamurai plugin by vendor Kiera Howe across all versions up to 1.0.7, and the Patchstack advisory classifies it as a broken access control issue. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N vector reflects a network-reachable, low-complexity attack requiring only low privileges, with high integrity impact and no confidentiality or availability impact.
Know when Websamurai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable missing-authorization flaw exploitable by any low-privileged authenticated user (PR:L), no interaction, affecting only integrity (I:H; C:N/A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB