EUVD-2026-93063
GHSA-mqg4-m7j5-x92p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber account on site
-
DeliverySend crafted authenticated request to plugin endpoint
-
ExploitBypass missing authorization check
-
ExecutionPerform unauthorized privileged action
-
ImpactCompromise site data and integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account at the WordPress Subscriber role or higher on a site running Progress Planner version 1.10.0 or earlier (PR:L); it is remotely reachable over the network with no user interaction. The practical limiting factor is the need for a valid account - risk is highest where open/self-service user registration is enabled, and substantially reduced on sites that restrict account creation. No special non-default plugin configuration is indicated in the available data; the condition is simply possession of a low-privilege session plus the vulnerable plugin version. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, with high confidentiality, integrity, and availability impact - consistent with CWE-862 (Missing Authorization), where an already-authenticated low-level account can reach functionality it should not. The 'low privilege' requirement maps directly to the description's 'Subscriber' level, the lowest default authenticated WordPress role, which is often self-registerable, materially lowering the barrier versus an admin-only flaw. However, no EPSS score, no CISA KEV listing, and no public POC were provided in the input, so this is a high-CVSS issue with no evidence of real-world or probable near-term exploitation at time of analysis - it should be patched promptly on affected sites but does not show the active-exploitation signals that would make it an emergency. The reliance on a valid (if low-privilege) account also means it is not a mass unauthenticated internet-wide threat; realistic risk concentrates on sites that permit open user registration. KEV/EPSS absence is noted as missing data, not as evidence of safety. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running Progress Planner <= 1.10.0, then sends a crafted authenticated request to a plugin endpoint that fails to verify the caller's authorization. Because no user interaction is needed and attack complexity is low, the attacker can perform actions or access data reserved for higher-privilege users, with full impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Broken access control in the Progress Planner WordPress plugin through version 1.10.0 allows any authenticated user holding the low-privileged Subscriber role (or higher) to reach plugin functionality they are not authorized to invoke, yielding high impact to confidentiality, integrity, and availability at a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is network-reachable, requires no user interaction and no elevated privileges beyond a valid low-privilege session, and is classified as CWE-862 (Missing Authorization); risk is greatest on sites that permit open or self-service registration and materially lower where account creation is locked down. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation in CISA KEV; the report originates from Patchstack. Authentication requirements are confirmed from the assessed vector, which carries PR:L, so exploitation is authenticated but does not require administrative access.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/progress-planner/vulnerability/wordpress-progress-planner-plugin-1-10-0-broken-access-control-vulnerability?_s_id=cve) and the plugin's WordPress.org release feed for a version above 1.10.0 and upgrade to that release; because the affected range is stated as '<= 1.10.0', any confirmed later release should resolve the missing authorization check, but do not treat an unverified version number as the fix until the vendor confirms it. If no fixed release is yet available, deactivate and remove the Progress Planner plugin until a patched version ships - the trade-off is loss of whatever progress/onboarding functionality it provides, but that is the only fully reliable control given a missing authorization check. Where the plugin must remain enabled, close the privilege gap: disable open registration in WordPress (Settings > General > 'Anyone can register' off) and audit existing Subscriber accounts, since the vulnerability is gated on holding a low-privilege session and self-service signup is the primary path an outside attacker would use to obtain one; the trade-off is that legitimate site members can no longer self-enroll and must be created manually. Additionally, restrict or block the plugin's REST and admin-ajax endpoints at the web application firewall or reverse proxy (allow only expected roles/IP ranges) and add monitoring for Subscriber-level requests to Progress Planner routes, though WAF rules are signature-dependent and may be bypassed by parameter or path variation. Rotate any credentials or secrets the plugin stores or exposes, since high confidentiality impact is assessed, and keep WordPress role assignments least-privileged in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the Progress Planner plugin for WordPress, a site-progress/onboarding management extension installed on self-hosted WordPress installations; the sole CPE entry, cpe:2.3:a:progress_planner:progress_planner:*:*:*:*:*:*:*:*, confirms a single vendor/product pair with all versions treated as affected in the range. The root cause class is CWE-862 Missing Authorization, meaning a request handler (typically a registered REST route, admin-ajax action, or admin-post endpoint exposed by the plugin) performs its operation without an adequate capability or nonce/authorization check, so the plugin's own authentication gate is absent even though the caller must still be logged in. In WordPress, authorization is normally enforced through capability checks such as current_user_can() against roles like manage_options; a Subscriber has essentially no capabilities beyond reading, so any privileged action reachable by a Subscriber indicates a missing or incorrectly scoped check rather than a flaw in WordPress core. The Patchstack tags 'WordPress', 'Authentication Bypass', and 'WordPress Plugin' describe this pattern of low-privilege privilege escalation into plugin-controlled functionality. Because the assessed vector is PR:L with no dependency on non-default configuration, the practical precondition is simply possession of any valid low-privilege session plus a vulnerable plugin install.
Know when Progress Planner gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable missing-authorization flaw exploitable by a self-registerable Subscriber account, so AV:N/AC:L/PR:L/UI:N; description implies full unauthorized access, hence high C/I/A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
Executive ViewAI
A high-severity authorization flaw in the Progress Planner WordPress plugin (versions through 1.10.0) allows any user with a basic Subscriber account to invoke plugin functionality reserved for higher-privileged roles, exposing site data and configuration to tampering or disruption. Because exploitation only requires a valid low-privilege login, any organization running the plugin on sites that allow open or self-service registration faces the greatest exposure, with potential compromise of confidentiality, integrity, and availability of the affected site. Leadership should care because this is a widely deployed third-party component with no vendor patch yet, and the attack path is reachable over the network without user interaction.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Progress Planner plugin (through version 1.10.0) on internet-facing sites, disable open/self-service registration, restrict or remove Subscriber and higher accounts that are not strictly required, enforce least-privilege role assignments, apply WAF or reverse-proxy rules to block unauthorized plugin endpoint access, and monitor WordPress audit logs for anomalous low-privilege administrative activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB