CVE-2026-24622
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24622 is a broken access control vulnerability in the WordPress Suggestion Toolkit Plugin (versions up to 5.0). It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions, which allows unprivileged users (like subscribers or developers) to perform actions that normally require higher privileges. [1]
How can this vulnerability impact me? :
This vulnerability could allow users without proper permissions to perform restricted actions within the Suggestion Toolkit plugin. However, the impact is considered low severity with a CVSS score of 5.4, and exploitation is unlikely to have a significant impact. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying unauthorized access attempts to privileged functions within the Suggestion Toolkit WordPress plugin. Since the issue stems from missing authorization checks, monitoring logs for unusual actions performed by low-privilege users (such as subscribers or developers) can help detect exploitation attempts. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the Suggestion Toolkit plugin functions to trusted users only, monitoring for suspicious activity, and using security services such as those offered by Patchstack to help protect affected WordPress sites. Since no official fix or patched version is available as of the publication date, applying strict access controls and monitoring is recommended. [1]