What is the CVSS score of CVE-2026-9184?

CVE-2026-9184 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

24liveblog Plugin CVE-2026-9184

EUVD-2026-38673 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-hwxf-h8x7-c976

WordPress Authentication Bypass Wordpress Plugin 24Liveblog Live Blog Tool

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:58 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 4.3

DescriptionCVE.org

The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the 'lb24' nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user's capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin's integration with the 24liveblog service.

AnalysisAI

Unauthorized token overwrite in the 24liveblog WordPress plugin (versions ≤ 2.2) enables any authenticated user with author-level access or above to hijack the site's 24liveblog service integration. The AJAX handler update_lb24_token() validates only a nonce that is automatically distributed to all block-editor-capable users, but performs no capability check and does not verify that the supplied user_id matches the requester - allowing an author-level attacker to overwrite lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname meta fields for any account including administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, and CVSS rates this as medium-low (4.3), consistent with the authenticated-only, integrity-limited impact.

Technical ContextAI

The vulnerability resides in the WordPress plugin identified by CPE cpe:2.3:a:24liveblog:24liveblog_-_live_blog_tool:*:*:*:*:*:*:*:*. WordPress AJAX handlers registered without a capability check represent a classic CWE-862 (Missing Authorization) pattern: the code at plugin.php lines 93-94 and 100-104 (per trac source references) registers and handles the update_lb24_token() function, and init.php line 127 reveals that the lb24 nonce is localized via lb24_block_enqueue_scripts(), a function invoked for any user who can access the block editor (i.e., authors and above). Because nonce possession is the sole gate and WordPress nonces do not encode user identity or role, any block-editor-capable user can replay a valid nonce alongside an arbitrary user_id to overwrite that target's integration credentials and the corresponding site-wide options in wp_options.

RemediationAI

No vendor-released patch version is identified at time of analysis - the Wordfence advisory and plugin trac references point to vulnerable trunk code with no corresponding fixed release documented in the provided data. Site administrators should immediately evaluate whether the plugin is necessary; if it is not actively used, deactivating and removing it eliminates the attack surface entirely with no trade-offs. If the plugin must remain active, restrict WordPress author-level and contributor-level roles to trusted users only, since that is the minimum privilege boundary for exploitation. WordPress site administrators can also monitor user meta changes for the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname keys as a detective control. Check the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f22854-049a-4b4f-a448-13c416e0a6b7 for patch availability updates.