CVE-2026-57649
Deferred Deferred - Pending Action
Subscriber Broken Access Control in Shoppable Images Lite

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-57649
EUVD
EUVD-2026-39764
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack mabel_shoppable_images_lite to 1.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The WordPress Shoppable Images Lite Plugin, versions 1.3 and below, contains a Broken Access Control vulnerability. This means that users with low-level permissions, such as those with a Subscriber role, can perform actions that should be restricted to higher-privileged users. The issue arises due to missing authorization, authentication, or nonce token checks.

Impact Analysis

This vulnerability allows unprivileged users to perform higher-privileged actions, potentially compromising the security of your WordPress site. Although the severity is considered low (CVSS score 4.3), it can be exploited in mass campaigns affecting many websites. This could lead to unauthorized changes or access within your site.

Users are advised to update to version 1.3.1 or later immediately to mitigate this risk. If updating is not possible, assistance from hosting providers or web developers is recommended.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WordPress Shoppable Images Lite Plugin to version 1.3.1 or later, which contains the patch that resolves the broken access control issue.

If updating is not possible immediately, users should seek assistance from their hosting provider or web developer.

Additionally, Patchstack users can enable auto-updates for vulnerable plugins to ensure timely patching.

Compliance Impact

The provided information does not specify how the Broken Access Control vulnerability in Shoppable Images Lite versions 1.3 and below directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart