CVE-2026-24627
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trusona | trusona_for_wordpress | to 2.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24627 is a Broken Access Control vulnerability in the WordPress plugin 'Trusona for WordPress' (versions up to and including 2.0.0). It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which may allow unprivileged users (like subscribers or developers) to perform actions meant only for higher-privileged roles. [1]
How can this vulnerability impact me? :
This vulnerability could allow users with lower privileges to perform actions reserved for higher-privileged roles, potentially leading to unauthorized changes or access within the WordPress site. However, it is considered low severity with a CVSS score of 4.3 and is unlikely to be exploited. No official fix is currently available, but mitigation solutions are offered through the Patchstack security platform. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves checking for unauthorized access attempts or privilege escalations within the Trusona for WordPress plugin, especially from low-privileged users performing actions reserved for higher-privileged roles. Since the vulnerability arises from missing authorization checks in certain functions, monitoring logs for unusual activity or using security scanning tools that detect broken access control issues in WordPress plugins can help. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the Trusona for WordPress plugin functions to trusted users only, monitoring for suspicious activity, and using Patchstack's security platform which offers mitigation solutions. Since no official fix or patched version is currently available, applying strict access controls and monitoring is recommended. [1]