EUVD-2026-93258
GHSA-jpqw-xf2f-65rh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber account on target site
-
ExploitIdentify unprotected plugin action
-
ExecutionSend authenticated request lacking authz check
-
ImpactModify plugin settings/data without authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account at Subscriber level or higher on a WordPress site running App for Cloudflare plugin version 1.10.1 or earlier - reflecting the PR:L in the CVSS vector. Exploitation is therefore limited to sites that permit user self-registration or to attackers already holding low-privilege credentials; it is not exploitable by fully unauthenticated remote attackers against a default locked-down site. No specific non-default plugin feature or configuration toggle is named in the description beyond the plugin being installed and active, and no user interaction is required (UI:N). The missing authorization check (CWE-862) affects plugin functionality, yielding unauthorized modification (I:H) with no confidentiality or availability impact. |
| Impact | This is a moderate-risk, authenticated vulnerability rather than a critical internet-facing emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) indicates a network-reachable, low-complexity flaw requiring low-level authenticated privileges (a Subscriber account) and no user interaction, with a high integrity impact but no confidentiality or availability impact - consistent with CWE-862 (Missing Authorization) allowing a low-privileged user to perform actions they should not. No EPSS score, CISA KEV listing, or public POC was provided in the input, so no public exploit identified at time of analysis and there is no evidence of active exploitation. The practical risk is bounded by the need for a valid Subscriber-level account, which limits exploitation to sites allowing user registration or to attackers who already hold credentials. No SSVC decision data was supplied. Note the input Tags label this 'Authentication Bypass,' but the CVSS vector requires PR:L (authentication IS needed) and the CWE is Missing Authorization - this is a broken access control / privilege issue, not a pre-authentication bypass; treat the 'Authentication Bypass' tag as imprecise. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privileged Subscriber account on a WordPress site running App for Cloudflare <= 1.10.1, then sends crafted authenticated requests to plugin endpoints that fail to verify the caller's authorization. Because integrity impact is High (C:N/A:N), the attacker can modify plugin settings or data they should not be able to touch. No public exploit code was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Authenticated attackers holding a Subscriber-level account or higher can exploit a missing authorization check in the WordPress plugin App for Cloudflare (versions 1.10.1 and earlier) to modify plugin settings without proper permissions. The vulnerability has a CVSS score of 6.5, requires low-privilege credentials on a site where the plugin is active, and results in unauthorized configuration changes with no confidentiality or availability impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; sites that allow user self-registration or that have existing low-privilege accounts are most at risk.
RemediationAI
No vendor-released patch version is identified in the available intelligence; administrators should check the Patchstack advisory and the WordPress plugin repository for an updated version beyond 1.10.1 and apply it immediately if available. If no update exists, temporarily deactivating the plugin is the safest action until a fix is released, though this removes Cloudflare integration features. As a compensating control, restrict user registration or disable Subscriber-level accounts on sites running the plugin; however, this may break membership or subscription functionality. Ensure that only administrators can access the plugin's settings pages through role configuration, but note that without a code fix the missing authorization check may still be exploitable via direct requests. A Web Application Firewall (WAF) with virtual patching rules from Patchstack or other vendors could block exploitation attempts if such rules are available, but this is a mitigation, not a substitute for patching. After applying a fix, audit Cloudflare configuration for unauthorized changes. Refer to the vendor advisory at https://patchstack.com/database/wordpress/plugin/app-for-cf/vulnerability/wordpress-app-for-cloudflare-plugin-1-10-1-broken-access-control-vulnerability for the latest patch information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a missing authorization vulnerability (CWE-862) in the WordPress plugin App for Cloudflare, which provides Cloudflare integration features such as cache management, settings synchronization, and firewall rule configuration from the WordPress dashboard. The plugin fails to perform a capability check on certain administrative actions, allowing a user with only the Subscriber role to invoke those actions. The affected component likely handles plugin settings updates via an AJAX or REST API endpoint that should be restricted to administrators. The CPE string cpe:2.3:a:digitalpoint:app_for_cloudflare®:*:*:*:*:*:*:*:* identifies the DigitalPoint-published plugin, and the vulnerability affects all versions up to and including 1.10.1. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates network-based exploitation requiring low privileges, no user interaction, and a scope-unchanged impact limited to integrity modification; confidentiality and availability are unaffected.
Know when App For Cloudflare gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable (AV:N), low complexity (AC:L), and requires a Subscriber account so PR:L not PR:N; missing authorization permits unauthorized modification (I:H) with no C/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB