CVE-2026-27344
Received Received - Intake
Missing Authorization in inseri-core ≤ 1.0.5 Enables Unauthorized Access

Publication date: 2026-03-05

Last updated on: 2026-04-28

Assigner: Patchstack

Description
Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-05
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-03-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27344
EUVD
EUVD-2026-9616
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
inseriswiss inseri_core to 1.0.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-27344 is a medium priority Broken Access Control vulnerability in the WordPress inseri core Plugin versions up to and including 1.0.5.

This vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions, which allows unauthenticated users to perform actions that normally require higher privileges.

It is classified under the OWASP Top 10 category A1: Broken Access Control.

Impact Analysis

This vulnerability allows unauthenticated users to perform privileged actions within the inseri core WordPress plugin, potentially leading to unauthorized access or modification of website data or functionality.

Because it bypasses access control, attackers could exploit this to compromise the security and integrity of the affected website.

The CVSS score of 5.9 indicates a moderate severity and a reasonable likelihood of exploitation.

No official patch is available yet, but mitigation rules from Patchstack can help block attacks until a patch is released.

Compliance Impact

I don't know

Detection Guidance

This vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions, allowing unauthenticated users to perform actions that require higher privileges.

There is no specific detection command or signature provided in the available resources.

Users are advised to monitor for unusual or unauthorized access attempts to the inseri core WordPress plugin endpoints, especially those that should require higher privileges.

Mitigation Strategies

No official patch has been released for this vulnerability as of the latest update.

Patchstack has developed and issued a mitigation rule that can block attacks exploiting this vulnerability.

Users are strongly advised to apply this mitigation promptly to protect their websites until an official patch becomes available.

Monitoring and restricting access to the affected inseri core plugin functions can also help reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart