WPZOOM Portfolio Lite EUVD-2026-107068

Requires an authenticated account with the Contributor role or higher on a WordPress site running WPZOOM Portfolio Lite before 1.4.34; no victim user interaction and no special plugin configuration are needed. Exploitation is limited by the need for a pre-existing low-privilege account - most impactful on multi-author sites or sites that allow open contributor registration. Impact is confined to content integrity (reassigning/moving others' posts and pages into portfolio items and breaking their URLs); no data disclosure or service disruption.

This is a moderate-risk broken-access-control (IDOR, CWE-639) flaw in the WPZOOM Portfolio Lite WordPress plugin before 1.4.34. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, 4.9) correctly reflects network reach, low attack complexity, no user interaction, and an integrity-only impact with no confidentiality or availability loss. However, the PR:H (high privileges) rating conflicts with the description, which states exploitation is possible by 'users with the contributor role and above' - Contributor is a LOW-privilege authenticated role, so PR:L is more accurate; this discrepancy slightly understates how easily the flaw can be reached on sites that permit contributor registration. No EPSS score and no SSVC decision data were provided, so automatability and exploitation-maturity signals cannot be quantified. Publicly available exploit code exists (reported by WPScan) but there is no CISA KEV listing and no evidence of active exploitation, so this should be treated as a patch-soon issue rather than an emergency. Net: real but bounded - it requires an existing authenticated account and only corrupts content integrity.

An attacker who holds (or registers for) a Contributor-level account on a WordPress site running the vulnerable plugin sends a crafted request to change the post type and order of a post or page they do not own. Because the plugin never verifies edit authorization, the victim's posts and pages are silently converted into portfolio items and removed from their original listings and URLs. Public exploit code exists (WPScan), lowering the effort required.