CVE-2026-9184
Deferred Deferred - Pending Action

Authentication Bypass in 24liveblog WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: Wordfence

Description
The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the 'lb24' nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user's capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin's integration with the 24liveblog service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-07-14
AI Q&A
2026-06-24
EPSS Evaluated
2026-07-13
NVD
CVE-2026-9184
EUVD
EUVD-2026-38673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
24liveblog live_blog_tool to 2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The 24liveblog plugin for WordPress has a vulnerability in its update_lb24_token() AJAX function where it fails to properly check user capabilities. Instead of verifying if the user has the right permissions, it only checks a nonce that any user with block editor access can obtain. This allows authenticated users with author-level access or higher to modify sensitive user meta data and site-wide options related to the plugin.

Specifically, attackers can overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname values for any user, including administrators, effectively hijacking the plugin's integration with the 24liveblog service.

Impact Analysis

This vulnerability can allow an attacker with author-level access or higher to hijack the 24liveblog plugin's integration by overwriting authentication tokens and user meta data for any user, including administrators.

As a result, the attacker could potentially manipulate live blog content or perform actions on behalf of other users, leading to unauthorized data modification and loss of control over the plugin's functionality.

Compliance Impact

The vulnerability allows authenticated attackers with author-level access and above to overwrite user meta values and site-wide options related to the 24liveblog plugin integration. This unauthorized modification of data could potentially lead to data integrity issues and unauthorized access to user-related information.

Such unauthorized data modification may impact compliance with data protection standards and regulations like GDPR and HIPAA, which require ensuring the confidentiality, integrity, and proper authorization of personal and sensitive data. However, the provided information does not explicitly detail the compliance impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart