CVE-2026-9184
Received Received - Intake
Authentication Bypass in 24liveblog WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: Wordfence

Description
The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_token() AJAX function in versions up to, and including, 2.2. The handler only verifies the 'lb24' nonce (which is generated and localized to any user with block editor access via lb24_block_enqueue_scripts()) and does not verify the user's capabilities or that the supplied user_id belongs to the current user. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values of any user (including administrators) as well as the corresponding site-wide options, effectively hijacking the plugin's integration with the 24liveblog service.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-24
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-9184
EUVD
EUVD-2026-38673
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
24liveblog live_blog_tool to 2.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The 24liveblog plugin for WordPress has a vulnerability in its update_lb24_token() AJAX function where it fails to properly check user capabilities. Instead of verifying if the user has the right permissions, it only checks a nonce that any user with block editor access can obtain. This allows authenticated users with author-level access or higher to modify sensitive user meta data and site-wide options related to the plugin.

Specifically, attackers can overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname values for any user, including administrators, effectively hijacking the plugin's integration with the 24liveblog service.

Impact Analysis

This vulnerability can allow an attacker with author-level access or higher to hijack the 24liveblog plugin's integration by overwriting authentication tokens and user meta data for any user, including administrators.

As a result, the attacker could potentially manipulate live blog content or perform actions on behalf of other users, leading to unauthorized data modification and loss of control over the plugin's functionality.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart