Wordable CVE-2026-40801

Exploitation requires the attacker to hold a Subscriber-level (low-privilege authenticated) account on a WordPress site running Wordable version 8.2.10 or earlier; the plugin fails to enforce authorization (capability) checks on one or more actions, so an authenticated low-privilege user can reach functionality intended for higher roles. The primary limiting factor is the authentication requirement (PR:L): the attacker must already have, or be able to register, an account - so the practical risk is far higher on sites that allow open user self-registration than on sites that restrict account creation. No special non-default plugin configuration is indicated by the available data; user interaction is not required (UI:N).

This is a genuine priority-tier vulnerability but with an important access caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) - consistent with the description's 'Subscriber' qualifier, meaning the attacker must hold at least a subscriber-level WordPress account. Impact is high to confidentiality and integrity (C:H/I:H) with no availability impact (A:N), yielding a base score of 8.1. Signal cross-reference is limited: no EPSS probability, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation despite the high base score. The risk is therefore real but contingent - on sites that permit open user registration (a common WordPress default for many deployments), a subscriber account is trivial to obtain, which materially lowers the practical bar implied by PR:L; on sites that disable self-registration, exploitation requires an attacker to first acquire a low-privilege account, making this closer to an insider or post-compromise escalation issue. No conflicting signals were found, but the exploitation-likelihood picture is incomplete due to missing EPSS/KEV/POC data.

An attacker registers or obtains a low-privilege subscriber account on a WordPress site running Wordable 8.2.10 or earlier, then invokes plugin actions that lack proper authorization (capability) checks. Because the missing-authorization flaw (CWE-862) exposes functions meant for higher-privileged users, the subscriber can read or alter data they should not access, such as plugin configuration or content-export operations. No public exploit code was identified at the time of analysis.