Stitch Express
Monthly
Broken access control in the Stitch Express WordPress plugin (versions <= 1.9.0) allows unauthenticated network attackers to perform privileged operations by bypassing missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms zero-friction remote exploitation with high integrity impact, meaning unauthorized data modification or administrative action is achievable without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Broken access control in the Stitch Express WordPress plugin (versions <= 1.9.0) allows unauthenticated network attackers to perform privileged operations by bypassing missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms zero-friction remote exploitation with high integrity impact, meaning unauthorized data modification or administrative action is achievable without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.