Civi Framework
Monthly
Broken access control in the Civi Framework WordPress plugin (versions <= 2.2.0) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in unauthorized integrity impact against the host WordPress site. Reported by Patchstack, this is a CWE-862 (Missing Authorization) flaw where protected endpoints fail to validate whether the requesting party has the necessary permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken access control in the Civi Framework WordPress plugin (versions <= 2.2.0) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in unauthorized integrity impact against the host WordPress site. Reported by Patchstack, this is a CWE-862 (Missing Authorization) flaw where protected endpoints fail to validate whether the requesting party has the necessary permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.