CVE-2026-110514

Deferred Deferred - Pending Action

WPZOOM Portfolio Lite Post Type Change Vulnerability

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-110514

EUVD

EUVD-2026-107068

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WPZOOM Portfolio Lite	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in the WPZOOM Portfolio Lite WordPress plugin before version 1.4.34 allows users with contributor role or higher to change any post or page type to a portfolio item without proper authorization checks. This is an Insecure Direct Object Reference (IDOR) flaw that removes content from original listings and URLs.

Detection Guidance

Check the installed version of the WPZOOM Portfolio Lite plugin. If it is below 1.4.34, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to reorganize your WordPress content by converting posts or pages into portfolio items. This disrupts site structure, breaks original URLs, and may cause data loss or misplacement of important content.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to modify or remove content without proper authorization. For GDPR, this may affect data integrity and user access controls, while for HIPAA, it could compromise protected health information if posts or pages containing such data are altered or removed.

Mitigation Strategies

Update the WPZOOM Portfolio Lite plugin to version 1.4.34 or later immediately. Review user roles and permissions to ensure contributors and above do not have unnecessary access to modify post types.

Hi! I’m here to help you understand CVE-2026-110514. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...