WP Admin Audit EUVD-2026-92309

Exploitation requires an existing authenticated session on the target WordPress site: per CVSS PR:L the attacker must already hold a low-privilege account, so this is not anonymously exploitable. The flaw is a missing capability/authorization check on a WP Admin Audit plugin function affecting all versions up to and including 1.2.17. No user interaction is required (UI:N) and no special non-default configuration is indicated by the description. Limiting factors: the need for any valid account, the confidentiality-only impact (C:L, I:N, A:N) restricting consequences to unauthorized data access, and the plugin's limited deployment footprint.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a vendor-reported CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning network-reachable, low-complexity exploitation by an already-authenticated low-privilege user, yielding only limited confidentiality impact and no integrity or availability impact. The signals are internally consistent and point to a low real-world priority rather than a critical issue: the scope is a single niche WordPress audit-logging plugin, impact is confined to unauthorized read access (C:L only), and exploitation requires a valid authenticated account (PR:L), which materially limits a purely anonymous attacker. No EPSS score was supplied, so statistical exploitation likelihood cannot be quantified from the input. The CVE is NOT on the CISA KEV list and no public exploit code was identified, so there is no public exploit identified at time of analysis. The only data source is a single Patchstack advisory; no independent NVD CPE version confirmation beyond 'n/a through 1.2.17' and no corroborating vendor advisory were provided. Overall, treat this as a low-to-moderate patch-when-convenient item, not an emergency.

An attacker who already holds a low-privileged authenticated account (e.g., a subscriber or contributor) on a WordPress site running WP Admin Audit ≤1.2.17 sends a request to a plugin endpoint that fails to verify the caller's capability. Because authorization is not enforced, the attacker reads audit-log data or other restricted information that should be limited to administrators. No public exploit code is known, but the low attack complexity (AC:L) and network vector (AV:N) make the action trivial once authenticated.