EUVD-2026-19594
GHSA-mhqr-7m5g-wj8v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.
AnalysisAI
Missing authorization in OceanWP Ocean Extra plugin versions through 2.5.3 allows authenticated users to bypass access control restrictions and perform unauthorized modifications or denial-of-service actions. An attacker with valid user credentials can exploit incorrectly configured access control checks to escalate privileges beyond their intended permission level. No public exploit code has been identified at time of analysis, but the vulnerability has been documented by Patchstack security researchers.
Technical ContextAI
OceanWP Ocean Extra is a WordPress plugin that extends the Ocean theme with additional functionality. The vulnerability stems from CWE-862 (Missing Authorization), which indicates that the plugin fails to properly validate user permissions before allowing access to sensitive functions or data modification operations. The affected product uses standard WordPress authentication mechanisms, but the authorization layer that should restrict actions to appropriate user roles has been improperly implemented, allowing authenticated users with lower privilege levels to access functionality intended for administrators or higher-privileged accounts.
RemediationAI
Update OceanWP Ocean Extra to a patched version released after 2.5.3 via the WordPress plugin management interface or directly from the official Ocean Extra repository. Organizations should verify patch availability through the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ocean-extra/vulnerability/wordpress-ocean-extra-plugin-2-5-3-broken-access-control-vulnerability and consult OceanWP's official security advisories for the specific fixed version. As an interim measure before patching, restrict user role permissions at the WordPress level to prevent lower-privileged accounts from accessing sensitive areas, though this does not eliminate the underlying vulnerability.
More in Ocean Extra
View allThe Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP obje
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually
The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up t
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter i
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortc
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter i
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.2.2. Rated medium severity (CVSS 5.4), this vulne
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OceanWP Oce
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today