What is the CVSS score of CVE-2026-4117?

CVE-2026-4117 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

CalJ Shabbat Times CVE-2026-4117

EUVD-2026-24658 MEDIUM

Missing Authorization (CWE-862)

2026-04-22 Wordfence

GHSA-5mhq-hh7f-vmww

PHP Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:03 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24658

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 5.3

DescriptionCVE.org

The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5. This is due to a missing capability check in the CalJSettingsPage class constructor, which processes the 'save-obtained-key' operation directly from POST data without verifying that the requesting user has the 'manage_options' capability, and without any nonce verification. The plugin bootstrap file (calj.php) instantiates CalJSettingsPage whenever is_admin() returns true, which is the case for any authenticated user making requests to wp-admin URLs (including admin-ajax.php). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API key setting and clear the Shabbat cache, effectively taking control of the plugin's API integration.

AnalysisAI

Authenticated users with Subscriber-level access can modify the CalJ Shabbat Times plugin's API key and clear its cache due to missing authorization checks in the CalJSettingsPage class constructor. The vulnerability affects all versions up to and including 1.5, with no special network or interaction requirements beyond valid WordPress authentication. While CVSS 5.3 reflects moderate integrity impact, the practical risk depends on whether WordPress sites allow Subscriber-level registrations and whether the plugin's API key provides sensitive access to external services.

Technical ContextAI

CalJ Shabbat Times is a WordPress plugin that integrates with an external Shabbat times API. The vulnerability exists in the CalJSettingsPage class constructor, which processes the 'save-obtained-key' POST operation without verifying the requesting user possesses the 'manage_options' WordPress capability (required for plugin configuration) or validating a nonce token. The plugin bootstrap file instantiates this class whenever is_admin() evaluates to true-a condition satisfied by any authenticated user accessing wp-admin URLs, including the admin-ajax.php endpoint. This design flaw bypasses WordPress's standard role-based access control (RBAC) mechanism. The root cause is CWE-862 (Missing Authorization), a fundamental failure to enforce privilege checks before sensitive operations. The attack surface is the plugin's settings save handler accessible via POST requests from the admin backend.

RemediationAI

No vendor-released patch has been independently confirmed at the time of this analysis; site administrators must implement compensating controls immediately. The definitive fix requires the plugin developer to add a capability check (current_user_can('manage_options')) and nonce verification (wp_verify_nonce()) to the CalJSettingsPage class constructor before processing the 'save-obtained-key' POST operation. Until an official patch is released, administrators should disable the CalJ plugin entirely if Subscriber-level registrations are permitted, or restrict wp-admin access to Administrator and Editor roles via .htaccess, firewall rules, or a Web Application Firewall (WAF) that blocks wp-admin requests from non-elevated user accounts. If the API key is sensitive, rotate it immediately and audit recent modifications via WordPress audit logs. Monitor the official plugin repository (https://plugins.trac.wordpress.org/browser/calj/) for version updates and subscribe to Wordfence vulnerability alerts (https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c7df8e-2f82-4474-88ef-8c8ddaeb4656) for patch notifications.