What is the CVSS score of CVE-2026-5347?

CVE-2026-5347 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

HM Books Gallery WordPress Plugin CVE-2026-5347

EUVD-2026-25398 MEDIUM

Missing Authorization (CWE-862)

2026-04-24 Wordfence

GHSA-7cw2-vvg5-h9pj

PHP WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 06:00 euvd

EUVD-2026-25398

Analysis Generated

Apr 24, 2026 - 06:00 vuln.today

CVE Published

Apr 24, 2026 - 05:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings.

AnalysisAI

Unauthenticated attackers can modify the custom post type slug for the HM Books Gallery plugin in WordPress versions up to 4.8.0 by submitting a crafted POST request to the admin_init hook, bypassing all capability and nonce checks. This vulnerability allows modification of the 'wbg_cpt_slug' option without authentication, changing the URL structure for all book entries, breaking existing links, and degrading SEO rankings. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The HM Books Gallery WordPress plugin uses the admin_init hook to process permalink settings updates. The vulnerable code at lines 205-209 of wp-books-gallery.php checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' WordPress option. WordPress admin_init executes for both authenticated and unauthenticated requests when no explicit capability checks are performed. The vulnerability stems from the absence of two critical WordPress security patterns: the current_user_can() function to verify administrator privileges and wp_verify_nonce() to validate request legitimacy. CWE-862 (Missing Authorization) is the root cause - the application fails to check if the user performing the action has the required permission level. This is a PHP-based WordPress plugin vulnerability affecting the admin settings processing layer.

RemediationAI

Immediately upgrade HM Books Gallery to version 4.8.1 or later, which addresses the missing authorization checks. The plugin maintainer has confirmed the fix in the referenced source code repository. If immediate upgrade is not possible, disable the HM Books Gallery plugin entirely until patching can be completed, as the vulnerability allows unauthenticated modification of critical site settings with no compensating control available. Website administrators should verify that the 'wbg_cpt_slug' option has not been modified to an unintended value post-upgrade by checking the plugin settings page and comparing book gallery URLs against known indexed URLs. For sites with significant book content already indexed, implement 301 redirects from old book URLs to new ones to preserve SEO value and user experience.