CVE-2026-24622

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-01-23

Last updated on: 2026-04-28

Assigner: Patchstack

Description

Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Suggestion Toolkit: from n/a through <= 5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-23

Last Modified

2026-04-28

Generated

2026-07-06

AI Q&A

2026-01-23

EPSS Evaluated

2026-07-05

NVD

CVE-2026-24622

EUVD

EUVD-2026-4313

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-24622 is a broken access control vulnerability in the WordPress Suggestion Toolkit Plugin (versions up to 5.0). It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions, which allows unprivileged users (like subscribers or developers) to perform actions that normally require higher privileges. [1]

Impact Analysis

This vulnerability could allow users without proper permissions to perform restricted actions within the Suggestion Toolkit plugin. However, the impact is considered low severity with a CVSS score of 5.4, and exploitation is unlikely to have a significant impact. [1]

Detection Guidance

Detection of this vulnerability involves identifying unauthorized access attempts to privileged functions within the Suggestion Toolkit WordPress plugin. Since the issue stems from missing authorization checks, monitoring logs for unusual actions performed by low-privilege users (such as subscribers or developers) can help detect exploitation attempts. Specific commands are not provided in the available resources. [1]

Mitigation Strategies

Immediate mitigation steps include restricting access to the Suggestion Toolkit plugin functions to trusted users only, monitoring for suspicious activity, and using security services such as those offered by Patchstack to help protect affected WordPress sites. Since no official fix or patched version is available as of the publication date, applying strict access controls and monitoring is recommended. [1]

Hi! I’m here to help you understand CVE-2026-24622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70