EUVD-2026-96536
GHSA-5h56-5m4c-fxjq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as subscriber account
-
DeliverySend request to unprotected plugin endpoint
-
ExploitMissing authorization check bypassed
-
ExecutionPerform privileged action
-
ImpactModify or disrupt site data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account on the target site: the description explicitly scopes this to the 'Subscriber' role, so the site must permit subscriber-level (or comparable) user accounts - typical of sites with open or membership registration enabled. The matching CVSS PR:L confirms authenticated (not unauthenticated) access is needed, and no user interaction is required (UI:N). The vulnerable WPSection plugin must be installed and at version 1.5.1 or earlier. Exploitation is limited by the need for that authenticated subscriber foothold and by the plugin's narrow deployment; it does not work against anonymous visitors or sites that disable self-registration. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates network-reachable, low-complexity exploitation requiring only low privileges (PR:L) - consistent with the description's 'Subscriber' broken access control, meaning any authenticated subscriber-level account can trigger it. Impact is high to integrity and availability with no confidentiality loss (C:N), matching a CWE-862 missing-authorization flaw where a low-privileged user performs actions reserved for higher roles rather than reading sensitive data. No EPSS score, no CISA KEV listing, and no public POC were supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.1 rating is therefore a theoretical severity rather than a demonstrated real-world priority. The main limiting factor is the PR:L requirement: exploitation presupposes that the target site allows subscriber (or similar low-tier) registration, which is common on membership/community sites but not universal. Given the obscurity of the affected plugin, realistic risk is best characterized as credible but low-urgency pending evidence of in-the-wild use. |
| Exploit ScenarioDerived | An attacker registers or already holds a low-privileged subscriber account on a WordPress site running WPSection <= 1.5.1, then invokes a plugin action or endpoint that fails to verify the caller's authorization (CWE-862), performing operations intended only for administrators. This lets them tamper with or destroy plugin-managed content/configuration, affecting integrity and availability. No public exploit code was identified in the provided data, so any attack would currently require the attacker to craft the request independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Broken access control in the WPSection WordPress plugin through version 1.5.1 allows an authenticated subscriber-level user to perform privileged actions that should be restricted to higher-privileged roles, resulting in high integrity and availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The flaw is a missing authorization check (CWE-862): the plugin does not verify that the calling user holds the capability the action demands, so any valid low-privileged account on an affected site - the description explicitly cites the Subscriber role - can trigger the vulnerable code paths without user interaction. Only sites running WPSection 1.5.1 or earlier that allow subscriber-level or comparable self-registration are realistically exposed, since an anonymous visitor cannot reach the functionality; no public exploit identified at time of analysis, and the plugin's narrow deployment base limits mass exploitation.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version is specified in the available intelligence, so the immediate priority is to determine whether the plugin can be removed or disabled - deactivating WPSection eliminates the vulnerable code paths entirely and is the cleanest mitigation, with the trade-off that its front-end functionality is lost. If the plugin must remain active, close the prerequisite rather than the flaw: disable open/self-registration and any membership workflow that creates Subscriber accounts, and audit existing subscriber accounts for ones that are unnecessary, since the vulnerability is only reachable by an authenticated low-privileged user. Hardening the Subscriber role with a role-capability editor (stripping capabilities the site does not require) narrows what a compromised or malicious subscriber account can do, though it will not reliably block a plugin that never checks capabilities in the first place. A WAF or reverse-proxy rule that restricts POST requests to admin-ajax.php, admin-post.php, or the plugin's REST namespace for users outside trusted roles reduces exposure but carries a real false-positive risk for legitimate low-privileged traffic and must be tuned. Continue to monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpsection/vulnerability/wordpress-wpsection-plugin-1-5-1-broken-access-control-vulnerability for a patched release and apply it as soon as one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPSection is a WordPress plugin, and the vulnerability class is CWE-862 (Missing Authorization), the canonical access-control weakness in the WordPress ecosystem. WordPress plugins commonly expose AJAX handlers (admin-ajax.php actions), REST API routes, or admin-post.php hooks whose callbacks perform state-changing operations but omit or misapply capability checks such as current_user_can() with an appropriate capability (e.g., manage_options or edit_posts). Because WordPress authenticates the request via cookies or nonces but the plugin never validates the caller's role, a user holding only the Subscriber role - the lowest default WordPress role, normally limited to managing their own profile - can invoke functionality intended for administrators or editors. The CVSS vector confirms the network attack surface (AV:N), low attack complexity (AC:L), and low privileges required (PR:L), with no user interaction (UI:N) and no scope change (S:U). Confidentiality impact is rated None (C:N), while integrity and availability impacts are both High (I:H/A:H), indicating the attacker can modify or destroy plugin-managed data or settings but is not assessed to read sensitive content. The supplied CPE cpe:2.3:a:rashid:wpsection:*:*:*:*:*:*:*:* identifies the vendor as 'rashid' and the product as 'wpsection' with a wildcard version field, so the version ceiling comes from the description (<= 1.5.1) rather than from the CPE itself. Reported by Patchstack through its WordPress vulnerability database, which is the primary coordination channel for plugin flaws of this type.
Know when Wpsection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Subscriber-level account needed so PR:L (not PR:N); network-exposed low-complexity request with no interaction; authorization-only flaw yields no confidentiality impact (C:N) but high integrity/availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
Executive ViewAI
WPSection WordPress plugin versions 1.5.1 and earlier contain a missing authorization check that allows any authenticated subscriber-level user to perform privileged actions, threatening website integrity and availability. Sites that permit subscriber self-registration are most exposed; no public exploit identified at time of analysis. Leadership should care because a compromised or unavailable public-facing site can disrupt services, damage trust, and require costly cleanup.
No vendor-released patch identified at time of analysis. Disable or remove WPSection 1.5.1 and earlier; disable subscriber self-registration; restrict low-privileged roles; deploy WAF/virtual patching to block unauthorized plugin actions; audit subscriber accounts and site integrity; monitor logs for privileged actions by subscriber-level users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB