What is the CVSS score of CVE-2026-54837?

CVE-2026-54837 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of All-In-One Intranet are affected by CVE-2026-54837?

All-In-One Intranet WordPress plugin (versions ≤ 1.8.1) contains a broken access control vulnerability that completely defeats its primary security function: restricting intranet content to…

How to fix or mitigate CVE-2026-54837?

Within 24 hours: inventory all WordPress installations using All-In-One Intranet plugin and verify current versions. Within 7 days: disable or remove the plugin from all affected instances; implement alternative access control mechanisms (Web Application Firewall rules, network-level authentication, or replacement intranet solutions). Within 30 days: conduct full audit of access logs for versions ≤ 1.8.1 to identify potential unauthorized content exposure; complete migration to a patched or alternative intranet platform.

All-In-One Intranet CVE-2026-54837

EUVD-2026-39680 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-p896-xrwf-h8qr

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote request bypasses the plugin's access control with no interaction (PR:N/UI:N/AV:N/AC:L); impact is read-only disclosure of private content, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:36 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.

AnalysisAI

Broken access control in the All-In-One Intranet WordPress plugin (versions ≤ 1.8.1) allows unauthenticated remote attackers to bypass the plugin's core 'force login / private site' restriction and read content that is supposed to be visible only to authenticated intranet members. The flaw is a missing authorization check (CWE-862) that undermines the single security feature the plugin exists to provide. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

All-In-One Intranet is a WordPress plugin whose primary function is to convert a public WordPress site into a private intranet by forcing visitors to log in before any page or post can be viewed, and optionally restricting the site to logged-in members only. This vulnerability is classed as CWE-862 (Missing Authorization), meaning a request path or resource served by the plugin (or content the plugin is meant to gate) is reachable without the access-control check that should enforce the 'private site' policy. Because the protection is implemented at the application layer by the plugin rather than the web server, any gap in that authorization logic re-exposes the underlying WordPress content directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms the impact is purely a confidentiality breach - disclosure of otherwise-private content - with no modification or denial of service.

RemediationAI

Update the All-In-One Intranet plugin to a release later than 1.8.1 as soon as the vendor publishes a fixed version - no exact patched version number is confirmed in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/all-in-one-intranet/vulnerability/wordpress-intranet-private-site-all-in-one-intranet-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve) and the plugin's WordPress.org page for the current version before deploying. If a patch is not yet available, do not rely on this plugin alone to keep sensitive content private: enforce access control at a layer the plugin does not own, for example placing the site behind HTTP Basic Auth at the web server, restricting access by IP allowlist or VPN, or using a virtual private patch / WAF rule (Patchstack offers one) to block the unauthorized access path. The trade-off of server-level Basic Auth or VPN gating is that it blocks all anonymous access including legitimate login flows and any intentionally public endpoints, so test member and admin login paths after applying it.