EUVD-2026-96058
GHSA-mmgc-4fx9-pwm9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level account on target site
-
DeliverySend unauthorized template publish/draft request
-
ExploitBypass missing authorization check
-
ExecutionPublish own template or draft admin's active template
-
ImpactDisrupt site layout or inject attacker content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with Contributor-level privileges or higher on a site running the Hello Plus plugin version 1.7.7 or earlier; the attacker then invokes the plugin's Hello+ header/footer template publish and draft actions, which fail to verify the user's authorization. Exploitation is limited by this authentication requirement (PR:L), so it is most relevant to multi-author sites or those permitting self-registration at Contributor level; no user interaction, non-default configuration, or specific platform is otherwise needed, and the impact is confined to template publishing (integrity) and drafting higher-privileged users' active templates (availability), with no data disclosure. |
| Impact | This is a moderate, authenticated access-control flaw (CWE-862, Missing Authorization) rather than a high-urgency crisis. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) tells a consistent story: network-reachable and low-complexity, but gated behind PR:L - the description confirms this means at least Contributor-level authenticated access. There is no confidentiality impact (C:N); impact is limited to integrity (I:L: publishing one's own Hello+ header/footer templates without authorization) and availability (A:L: drafting currently-active templates owned by higher-privileged users, which can disrupt a live site's layout). No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no signal of active exploitation. The signals are internally consistent - nothing contradicts the CVSS vector - so this ranks as a real but lower-tier priority: it requires an existing semi-trusted account (Contributor), which limits the realistic attacker population to multi-author sites or environments allowing open registration at Contributor level. Priority should be elevated chiefly on multi-author WordPress installations; single-admin sites face negligible practical risk. |
| Exploit ScenarioDerived | On a multi-author WordPress site running Hello Plus 1.7.7 or earlier, an attacker who holds (or registers for) a Contributor account sends a request to publish their own Hello+ header/footer template without the normally required authorization. The same missing-authorization check also lets them revert an administrator's currently-active template to draft status, defacing or disrupting the live site layout. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means no special timing or configuration is needed once a Contributor account exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Authorization bypass in the Hello Plus plugin for WordPress (all versions up to and including 1.7.7) allows authenticated users holding Contributor-level privileges or higher to publish their own Hello+ header/footer templates and to draft active templates belonging to higher-privileged users. The plugin's template-parts actions do not verify that the caller is authorized to publish or modify those documents, so the flaw is an integrity and availability problem rather than a data-disclosure one. Exploitation requires a valid low-privileged WordPress account, making multi-author sites and sites that allow Contributor-level self-registration the primary exposure; no public exploit code has been identified at time of analysis and there is no indication of active exploitation.
RemediationAI
The upstream fix is contained in Hello Plus Trac changeset 3537433, which adds the missing authorization checks to the template-parts document handlers; because that reference is a code changeset rather than a tagged release, treat this as upstream fix available (PR/commit) with a released patched version not independently confirmed, and confirm the plugin build you deploy actually contains changeset 3537433 before considering the site remediated. Until a verified patched release is installed, apply compensating controls: remove or tightly restrict the Contributor role on affected sites, disable open self-registration or require manual approval so attackers cannot obtain the PR:L account the exploit needs, and use a role-management plugin to strip publish/edit-others capabilities from non-trusted users. Additionally, audit existing Hello+ header and footer templates for unexpected publisher or status changes and restore any legitimate templates that were drafted, accepting the operational overhead of manual review; note that restricting Contributor capabilities can break legitimate multi-author workflows, so scope the change to the affected site role set rather than globally. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1e0b89-9bac-4a3b-bb8c-278449789214?source=cve for the vendor's remediation guidance and updated version information.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hello Plus is a WordPress theme/plugin component (vendor listed as 'elemntor' in the affected CPE, cpe:2.3:a:elemntor:hello_plus) that supplies Hello+ header and footer template parts, implemented in modules/template-parts via components/document.php and documents/ehp-document-base.php. The root cause is CWE-862, Missing Authorization: the publish and draft operations exposed through those template-part handlers are not gated by a capability check (for example an appropriate current_user_can() test tied to the document owner or to publish_pages/edit_others_posts), so the plugin trusts the request rather than the session. Because the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, the attacker must already be authenticated (PR:L) but needs no user interaction, no special configuration, and can reach the vulnerable action over the network. Impact stays within scope: unauthorized writes to template content (Integrity: Low) and the drafting of templates that are currently active for other users (Availability: Low), with no confidentiality loss.
Know when Hello Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Contributor-level authentication required (PR:L); network-reachable low-complexity action; no data disclosure (C:N); integrity and availability limited to template manipulation (I:L/A:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish their own Hello+ header/footer templates and draft currently active templates owned by higher-privileged users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB