What is the CVSS score of CVE-2026-4124?

CVE-2026-4124 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-4124

EUVD-2026-20842 MEDIUM

Missing Authorization (CWE-862)

2026-04-09 Wordfence

GHSA-8w6x-cfx6-w753

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 03:30 euvd

EUVD-2026-20842

Analysis Generated

Apr 09, 2026 - 03:30 vuln.today

CVE Published

Apr 09, 2026 - 02:25 nvd

MEDIUM 5.4

DescriptionCVE.org

The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wp_ajax_ziggeo_ajax handler only verifies a nonce (check_ajax_referer) but performs no capability checks via current_user_can(). Furthermore, the nonce ('ziggeo_ajax_nonce') is exposed to all logged-in users on every page via the wp_head and admin_head hooks . This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke multiple administrative operations including: saving arbitrary translation strings (translations_panel_save_strings via update_option('ziggeo_translations')), creating/updating/deleting event templates (event_editor_save_template/update_template/remove_template via update_option('ziggeo_events')), modifying SDK application settings (sdk_applications operations), and managing notifications (notification_handler via update_option('ziggeo_notifications')).

AnalysisAI

Ziggeo plugin for WordPress up to version 3.1.1 allows authenticated attackers with Subscriber-level access or above to perform unauthorized administrative operations including modifying translations, creating or deleting event templates, changing SDK settings, and managing notifications through missing capability checks in AJAX handlers. While nonce validation is present, the absence of current_user_can() checks combined with nonce exposure to all logged-in users enables privilege escalation from basic subscribers to near-administrative functionality. CVSS 5.4 reflects moderate impact with low complexity exploitability.

Technical ContextAI

The vulnerability stems from incomplete authorization validation in WordPress AJAX handlers (CWE-862: Missing Authorization). The wp_ajax_ziggeo_ajax handler and related AJAX endpoints verify request authenticity via check_ajax_referer() against the 'ziggeo_ajax_nonce' nonce, but omit capability checks using current_user_can() to validate whether the authenticated user has permission to perform the requested action. WordPress nonces provide CSRF protection but not privilege enforcement; the nonce is globally exposed via wp_head and admin_head hooks to all logged-in users regardless of role. This design flaw allows any logged-in user (including those with minimal Subscriber role) to craft valid AJAX requests to handlers intended for administrators, such as translations_panel_save_strings, event_editor_save_template, and notification_handler. These handlers directly invoke update_option() with administrator-level option keys (ziggeo_translations, ziggeo_events, ziggeo_notifications) without verifying the caller's capabilities. The affected product is identified by CPE cpe:2.3:a:oliverfriedmann:ziggeo:*:*:*:*:*:*:*:* with all versions up to 3.1.1 vulnerable.

RemediationAI

Update the Ziggeo plugin to the patched version released by Oliver Friedmann following this disclosure. Install the latest available version from the WordPress plugin repository (wordpress.org/plugins/ziggeo/). The fix must include adding current_user_can('manage_options') or appropriate capability checks to all AJAX handlers before executing administrative operations, and restricting nonce exposure to only authenticated users with sufficient privileges. As an interim mitigation before patching, site administrators should: (1) restrict Subscriber account creation to trusted users only; (2) audit existing Subscriber accounts and demote or remove inactive ones; (3) use WordPress user role plugins to limit capabilities granted to Subscriber accounts; (4) monitor update_option() calls in site audit logs for suspicious modifications to ziggeo_translations, ziggeo_events, or ziggeo_notifications. Refer to the Wordfence vulnerability intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/15477c00-0764-4850-8bce-d65b6b1cbe4c) for confirmation of patched version details once available.