Before After Image CVE-2026-62028

Exploitation requires the vulnerable 'Before After Image Comparison - Image comparison for WP' plugin (version n/a through 1.1.21) installed and active on a WordPress site, plus an authenticated account at a low privilege level (PR:L per the CVSS vector) - a self-registration-enabled site or any multi-user/membership deployment provides the needed foothold. The limiting factor is the authentication requirement: fully unauthenticated visitors cannot exploit it, so single-administrator sites with no untrusted registered users face minimal realistic exposure. No user interaction is required (UI:N), and impact is bounded to partial confidentiality and integrity of plugin-controlled data (C:L/I:L, no availability impact).

This is a medium-severity (CVSS 5.4) broken access control / missing authorization flaw (CWE-862) in the bPlugins 'Before After Image Comparison' WordPress plugin, affecting all versions up to and including 1.1.21. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring an authenticated low-privilege account (PR:L), with only partial confidentiality and integrity impact and no availability impact - consistent with a subscriber- or contributor-level user reaching plugin functions gated by improperly configured access-control checks. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (no CVSS-versus-description conflict), and the modest impact plus the authentication requirement place this as a routine patch-management item rather than an emergency: real priority is moderate - elevate for multi-author or membership WordPress sites where low-privilege accounts are untrusted, deprioritize for single-admin sites. EPSS is absent (not low), so widespread automated exploitation cannot be inferred either way.

An attacker who holds any low-privilege authenticated account (e.g., subscriber or contributor) on a WordPress site running the vulnerable plugin sends a request to a plugin action or endpoint that fails to verify the caller's authorization. Because the access-control check is missing or misconfigured, the attacker reads or modifies plugin-managed data they should not reach. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means no special timing or conditions are needed once a foothold account exists.