EUVD-2026-89907
GHSA-mj46-mx95-xr86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber account
-
ExploitSend crafted request to unprotected plugin endpoint
-
ExecutionBypass missing capability check
-
ImpactRead or alter restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Subscriber-level (or higher) account on a WordPress site running AllAble Connector <= 0.13.4 - the PR:L vector confirms low-privilege authentication is needed, which self-service registration typically satisfies. No user interaction is required (UI:N) and the flaw is remotely reachable over the network (AV:N/AC:L). Limiting factors: exploitation is confined to sites that have this specific, low-footprint plugin installed and that permit account registration, and impact is bounded to partial confidentiality/integrity (C:L/I:L) rather than full compromise. The exact vulnerable feature or endpoint is not disclosed in the available data. |
| Impact | This is a moderate-severity broken access control flaw (CVSS 5.4, CWE-862) in a niche WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring only Subscriber-level authentication (PR:L) and no user interaction, but with only low confidentiality and integrity impact and no availability impact. No EPSS score, KEV listing, or public POC was provided, so all three exploitation signals point to low real-world urgency. This reads as a real-but-minor issue: the authentication barrier (any logged-in low-privilege user) plus the constrained impact (partial data read/write, no full compromise, no scope change) keep it well below priority-patch territory. The single Patchstack reference is the only source, so severity rests entirely on their triage - no independent NVD/vendor corroboration of impact scope. Net: low-to-moderate priority, driven more by ease of access than by consequence. |
| Exploit ScenarioDerived | An attacker registers a free Subscriber account (or uses an existing low-privilege login) on a WordPress site running AllAble Connector 0.13.4 or earlier, then sends a crafted request to a plugin endpoint that fails to enforce a proper capability/authorization check. This lets them read or modify data they should not be able to touch (C:L/I:L). No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Broken access control in the WordPress plugin AllAble Connector (versions up to and including 0.13.4) lets an authenticated attacker holding only a low-privilege Subscriber account invoke functionality that should be restricted to higher-privileged users, resulting in partial loss of confidentiality and integrity (CVSS 5.4, CWE-862). Exploitation requires the attacker to already hold a Subscriber-level or higher account on a site running the vulnerable plugin - a bar that self-service registration on many WordPress sites meets - but needs no user interaction and is reachable remotely, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The flaw was reported by Patchstack; no public exploit code has been identified and there is no indication of confirmed active exploitation (not in CISA KEV), and the exact vulnerable endpoint has not been disclosed in the available data.
RemediationAI
No vendor-released patch identified at time of analysis: the available data supplies only the affected boundary of <= 0.13.4 and no fixed version, so check the vendor's plugin page and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/allable-connector/vulnerability/wordpress-allable-connector-plugin-0-13-4-broken-access-control-vulnerability?_s_id=cve for a patched release before upgrading. Until an update exists, the most effective compensating control for a low-footprint plugin of this type is to deactivate and remove AllAble Connector from any site that does not actively depend on it, which eliminates the attack surface entirely at the cost of losing the plugin's functionality. Where the plugin must remain active, close the authentication precondition by disabling open user registration (Settings > General > Membership: 'Anyone can register', and set the default role to something with no privileges) - note this breaks legitimate self-service signup workflows. Site operators should also audit Subscriber accounts for unexpected ones created during the exposure window, and review web server logs for anomalous admin-ajax.php or /wp-json/ requests originating from low-privileged sessions, since a successful exploit would leave traces of privileged actions performed by Subscriber-level users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization), a WordPress plugin-level failure to verify that the requesting user holds the correct capability before executing a privileged action. WordPress plugins typically expose such actions through AJAX handlers (wp_ajax_* / admin-ajax.php) or REST API routes, and rely on capability checks (current_user_can) plus nonce verification to gate them; when those checks are absent or incomplete for Subscriber-level users, the endpoint becomes reachable by any logged-in account created through open registration. The CPE identifier cpe:2.3:a:flexyma:allable_connector:*:*:*:*:*:*:*:* confirms the affected component is the FlexyMa AllAble Connector plugin across all unversioned ranges up to the 0.13.4 release boundary. The plugin's vulnerability entry is tagged by the reporter as an authentication bypass, but the provided CVSS vector (PR:L) and independent assessment constrain the flaw to privilege escalation from a low-privileged authenticated Subscriber rather than unauthenticated takeover, so the impact is bounded to partial read/write of protected data rather than full site compromise.
Know when Allable Connector gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint exploitable by any low-privilege authenticated user (PR:L) without interaction; missing authorization yields partial read/write (C:L/I:L) with no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB