CVE-2026-22445
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apimo | apimo_connector | to 2.6.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22445 is a Broken Access Control vulnerability in the WordPress Apimo Connector Plugin (versions up to 2.6.4). It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions, which allows unauthenticated users to perform actions that should require higher privileges. [1]
How can this vulnerability impact me? :
This vulnerability could allow unauthorized users to perform privileged actions within the Apimo Connector Plugin, potentially leading to unauthorized access or changes. However, it is considered low severity with a CVSS score of 5.3 and low priority, so no significant threat is expected from exploitation. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or methods provided for this vulnerability. Since it involves missing authorization checks in the Apimo Connector Plugin, detection would typically require reviewing plugin function calls or monitoring for unauthorized access attempts, but no explicit commands or tools are mentioned. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the Apimo Connector Plugin functions by limiting user permissions and monitoring for unauthorized activity. Since there is no official fix or patched version available as of the publication date, applying strict access controls and possibly disabling the plugin until a fix is released are recommended. [1]