EUVD-2026-112023
GHSA-hhx4-fq39-gx2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
ExploitSend request to plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactPerform unauthorized action or data access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress user with at least low-level privileges (PR:L - a logged-in account such as subscriber) on a site running My Auctions Allegro free edition from an unspecified initial version through 4.0.3; the plugin fails to enforce an authorization check on a privileged function, allowing that user to act beyond their role. Limiting factors: exploitation is not available to fully unauthenticated/anonymous visitors, impact is confined to low confidentiality and low integrity with no availability effect, and the site must have this specific plugin installed and active. The precise feature, endpoint, or configuration that exposes the unauthorized function is not described in the available sources. |
| Impact | This is a moderate-severity Missing Authorization flaw (CWE-862) in the WordPress plugin My Auctions Allegro (free edition), rated CVSS 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The CVSS vector indicates a network-reachable, low-complexity issue that nonetheless requires some level of privilege (PR:L), meaning an authenticated - not anonymous - actor, consistent with a typical WordPress low-privilege (e.g. subscriber/author) account performing an action the plugin fails to authorize. Impact is limited: low confidentiality and low integrity, no availability impact and no scope change, so this is not a site-takeover-class bug. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no working exploit is referenced - only a Patchstack advisory. The vuln.today priority decision is 'this_month', which aligns with a real-but-not-urgent issue: no evidence of active exploitation, but the low attack complexity and only low-privilege requirement make it a credible candidate for patching within a normal cycle rather than an emergency. Signals are internally consistent (moderate CVSS, no KEV, this_month decision); the main missing signals are EPSS probability and any confirmed exploitation data. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege authenticated account (such as a subscriber) on a WordPress site running My Auctions Allegro free edition 4.0.3 or earlier sends a crafted request to a plugin function that lacks a proper authorization check, performing an action or reading/modifying data they should not be permitted to. Because attack complexity is low and no user interaction is needed, the request succeeds directly against the vulnerable endpoint. No public exploit was identified at time of analysis; only a Patchstack advisory reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Broken access control in the WordPress plugin My Auctions Allegro (free edition), versions through 4.0.3, allows a logged-in low-privilege user such as a subscriber to invoke plugin functionality that should be restricted to higher roles, yielding limited data exposure and limited unauthorized modification. The flaw is a missing authorization check (CWE-862) rated CVSS 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, so anonymous visitors cannot exploit it, but any account on the site can serve as the starting point. No public exploit code or active exploitation has been reported, and the specific endpoint or feature that exposes the unprotected function is not described in the available sources.
RemediationAI
The provided data does not list a fixed release for this plugin, so patch status is not confirmed; check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/my-auctions-allegro-free-edition/vulnerability/wordpress-my-auctions-allegro-plugin-4-0-3-broken-access-control-vulnerability?_s_id=cve and the plugin's WordPress.org listing for a version newer than 4.0.3 before upgrading. If no fixed version is available, the most complete compensating control is to deactivate and remove My Auctions Allegro until an update ships, accepting the loss of auction-listing functionality; if the plugin must stay active, restrict the site's account base by disabling open user registration, reviewing and removing unnecessary subscriber-level accounts, and tightening role assignments, which reduces but does not eliminate exposure because any valid low-privilege login can still reach the unprotected function. Because the vulnerable endpoint is not identified in the available sources, targeted request filtering at the WAF or reverse proxy is not feasible without first mapping the plugin's AJAX/REST routes, and any such rule would risk blocking legitimate plugin traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
My Auctions Allegro is a WordPress plugin (free edition, slug my-auctions-allegro-free-edition, vendor wphocus) that adds Allegro auction listing functionality to a WordPress site; CPE cpe:2.3:a:wphocus:my_auctions_allegro:*:*:*:*:*:*:*:* confirms this is the plugin code itself rather than the WordPress core or web server. CWE-862 (Missing Authorization) means a privileged operation is reachable without the code verifying that the caller holds the required capability, a common failure pattern in plugin AJAX handlers, REST routes, or admin-post endpoints that register an action but omit a current_user_can() capability check (and possibly a nonce check). Because the CVSS vector is PR:L, the missing check is only exploitable by an already-authenticated account, not by anonymous traffic; the trigger path, HTTP route, and affected configuration are not described in the available sources, so the exact mechanism beyond the absence of an authorization gate cannot be confirmed.
Know when My Auctions Allegro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Missing authorization on a web-facing plugin action is network and low-complexity; it needs a logged-in low-privilege account (PR:L), yielding limited low confidentiality and integrity impact and no availability loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB