CVE-2026-27344
Missing Authorization in inseri-core ≤ 1.0.5 Enables Unauthorized Access
Publication date: 2026-03-05
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| inseriswiss | inseri_core | to 1.0.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27344 is a medium priority Broken Access Control vulnerability in the WordPress inseri core Plugin versions up to and including 1.0.5.
This vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions, which allows unauthenticated users to perform actions that normally require higher privileges.
It is classified under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated users to perform privileged actions within the inseri core WordPress plugin, potentially leading to unauthorized access or modification of website data or functionality.
Because it bypasses access control, attackers could exploit this to compromise the security and integrity of the affected website.
The CVSS score of 5.9 indicates a moderate severity and a reasonable likelihood of exploitation.
No official patch is available yet, but mitigation rules from Patchstack can help block attacks until a patch is released.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions, allowing unauthenticated users to perform actions that require higher privileges.
There is no specific detection command or signature provided in the available resources.
Users are advised to monitor for unusual or unauthorized access attempts to the inseri core WordPress plugin endpoints, especially those that should require higher privileges.
What immediate steps should I take to mitigate this vulnerability?
No official patch has been released for this vulnerability as of the latest update.
Patchstack has developed and issued a mitigation rule that can block attacks exploiting this vulnerability.
Users are strongly advised to apply this mitigation promptly to protect their websites until an official patch becomes available.
Monitoring and restricting access to the affected inseri core plugin functions can also help reduce risk.