EUVD-2026-102231
GHSA-w9rw-28h3-4f32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WordPress user
-
ExploitSend request to WordLift endpoint lacking capability check
-
ExecutionPerform unauthorized read/modify action
-
ImpactPartial data disclosure or tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account on a site running the WordLift plugin version n/a through 3.54.15 (PR:L); a low-privilege role such as subscriber or contributor is sufficient and no user interaction is needed (UI:N). The practical limiting factor is that the attacker must first obtain a valid account - most impactful on sites that permit open user registration or on multi-author/membership sites. The description does not name a specific feature or non-default setting, so the condition is the general requirement of plugin installation plus any authenticated session; impact is bounded to partial confidentiality and integrity (C:L/I:L) with no availability effect. |
| Impact | This is a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity missing-authorization flaw (CWE-862) that requires an already-authenticated low-privilege account (PR:L) and yields only limited confidentiality and integrity impact with no availability impact - consistent with a low-privileged WordPress user (e.g., subscriber/contributor) reaching functionality they should not. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; exploitation probability signals are simply absent rather than low. The single source is Patchstack, which classifies this as a broken access control issue. Net: real but secondary - a privilege/authorization gap worth patching in the normal cycle, not an emergency, given the authentication prerequisite and partial impact. Note a minor labeling tension: the input Tag 'Authentication Bypass' conflicts with the actual class (missing authorization against an authenticated user, not an auth bypass) - treat it as broken access control. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged authenticated account on a WordPress site running WordLift ≤ 3.54.15 (e.g., a self-registered subscriber on a site with open registration) sends requests to plugin endpoints that fail to enforce proper capability checks. This lets them read or alter plugin-managed data or settings beyond their role. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Broken access control in the WordLift WordPress plugin (all versions through 3.54.15) lets an authenticated low-privilege user - a subscriber or contributor is sufficient - reach functionality that should be reserved for higher-privileged roles, yielding limited data disclosure and modification with a CVSS 3.1 score of 5.4 (C:L/I:L, no availability impact). Exploitation requires only a valid account on a site running the plugin, which makes open-registration, membership, and multi-author sites the most exposed; no user interaction is needed. There is no public exploit code and no confirmed active exploitation (no CISA KEV listing), so this is a moderate, not critical, priority - but it should be remediated promptly because the barrier to entry is a free account.
RemediationAI
Vendor-released patch: not confirmed in the available data - the advisory names 3.54.15 as the top of the affected range but does not identify a fixed version, so operators should track the Patchstack advisory page (https://patchstack.com/database/wordpress/plugin/wordlift/vulnerability/wordpress-wordlift-plugin-3-54-15-broken-access-control-vulnerability?_s_id=cve) and the WordPress.org plugin page for the next release and update to it as soon as it is published; do not assume 3.54.16 exists without confirming it. Because the prerequisite is merely an authenticated low-privilege account, the highest-value compensating controls are account-side: disable open self-registration and require admin approval for new users, and audit existing subscriber/contributor/author accounts for anything unexpected - the trade-off is that legitimate community or membership sign-ups will need manual handling. If the site does not need the plugin's front-end or editorial semantic features, deactivate WordLift entirely until a fix is available; this guarantees removal of the exposure at the cost of losing the plugin's content-enrichment functionality. Additional measures with clearer trade-offs include tightening role definitions so fewer users sit at the lowest privilege tier (which may break legitimate publishing workflows), and, where a WAF or virtual patching layer is already deployed, using it to require elevated capabilities on the plugin's admin-ajax/REST endpoints - this is best-effort since the affected route is not named in the advisory and may be bypassed by direct requests. Since no public exploit code exists, there is no urgency for emergency mitigations, but the low privilege bar argues against leaving the plugin unpatched indefinitely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization): plugin functionality - typically an AJAX action or REST route registered by the WordLift SEO/semantic-content plugin - performs its work without verifying that the calling user actually holds the capability required for that operation. Because WordPress resolves the current user from the session cookie before dispatch, any authenticated account is treated as a legitimate caller unless the handler explicitly checks capabilities (for example via current_user_can) or validates a nonce tied to the intended action. The CPE cpe:2.3:a:wordlift_srl:wordlift:*:*:*:*:*:*:*:* confirms the affected component is the WordLift plugin from vendor WordLift Srl distributed through the WordPress.org plugin channel, and the wildcard version component reflects the advisory's 'from n/a through 3.54.15' range rather than a single pinned build. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - consistent with the Patchstack tag 'Authentication Bypass' - indicates the flaw is network-reachable, low complexity, requires low privileges (PR:L) and no user interaction, is scoped to the plugin, and is bounded to partial confidentiality and integrity loss with no denial-of-service component. This is an access-control configuration defect rather than a memory-safety or injection flaw, so impact depends on what privileged operations the unprotected handler exposes.
Know when Wordlift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Missing authorization reachable over the network by any authenticated low-privilege user (PR:L, AC:L, UI:N), yielding partial read/modify (C:L/I:L) and no availability loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB