EUVD-2026-20842
GHSA-8w6x-cfx6-w753
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wp_ajax_ziggeo_ajax handler only verifies a nonce (check_ajax_referer) but performs no capability checks via current_user_can(). Furthermore, the nonce ('ziggeo_ajax_nonce') is exposed to all logged-in users on every page via the wp_head and admin_head hooks . This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke multiple administrative operations including: saving arbitrary translation strings (translations_panel_save_strings via update_option('ziggeo_translations')), creating/updating/deleting event templates (event_editor_save_template/update_template/remove_template via update_option('ziggeo_events')), modifying SDK application settings (sdk_applications operations), and managing notifications (notification_handler via update_option('ziggeo_notifications')).
AnalysisAI
Ziggeo plugin for WordPress up to version 3.1.1 allows authenticated attackers with Subscriber-level access or above to perform unauthorized administrative operations including modifying translations, creating or deleting event templates, changing SDK settings, and managing notifications through missing capability checks in AJAX handlers. While nonce validation is present, the absence of current_user_can() checks combined with nonce exposure to all logged-in users enables privilege escalation from basic subscribers to near-administrative functionality. CVSS 5.4 reflects moderate impact with low complexity exploitability.
Technical ContextAI
The vulnerability stems from incomplete authorization validation in WordPress AJAX handlers (CWE-862: Missing Authorization). The wp_ajax_ziggeo_ajax handler and related AJAX endpoints verify request authenticity via check_ajax_referer() against the 'ziggeo_ajax_nonce' nonce, but omit capability checks using current_user_can() to validate whether the authenticated user has permission to perform the requested action. WordPress nonces provide CSRF protection but not privilege enforcement; the nonce is globally exposed via wp_head and admin_head hooks to all logged-in users regardless of role. This design flaw allows any logged-in user (including those with minimal Subscriber role) to craft valid AJAX requests to handlers intended for administrators, such as translations_panel_save_strings, event_editor_save_template, and notification_handler. These handlers directly invoke update_option() with administrator-level option keys (ziggeo_translations, ziggeo_events, ziggeo_notifications) without verifying the caller's capabilities. The affected product is identified by CPE cpe:2.3:a:oliverfriedmann:ziggeo:*:*:*:*:*:*:*:* with all versions up to 3.1.1 vulnerable.
RemediationAI
Update the Ziggeo plugin to the patched version released by Oliver Friedmann following this disclosure. Install the latest available version from the WordPress plugin repository (wordpress.org/plugins/ziggeo/). The fix must include adding current_user_can('manage_options') or appropriate capability checks to all AJAX handlers before executing administrative operations, and restricting nonce exposure to only authenticated users with sufficient privileges. As an interim mitigation before patching, site administrators should: (1) restrict Subscriber account creation to trusted users only; (2) audit existing Subscriber accounts and demote or remove inactive ones; (3) use WordPress user role plugins to limit capabilities granted to Subscriber accounts; (4) monitor update_option() calls in site audit logs for suspicious modifications to ziggeo_translations, ziggeo_events, or ziggeo_notifications. Refer to the Wordfence vulnerability intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/15477c00-0764-4850-8bce-d65b6b1cbe4c) for confirmation of patched version details once available.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today