Subscriber Broken Authentication in Leyka <= 3.32.3

Executive Summary

CVE-2026-66677 is a Broken Authentication vulnerability in the WordPress Leyka Plugin versions 3.32.3 and below. It allows users with subscriber-level access to perform actions meant for higher-privileged users, potentially leading to unauthorized admin access.

Useful 0 Not Useful 0

Detection Guidance

Check if the Leyka plugin version 3.32.3 or below is installed on your WordPress site. Look for unauthorized admin actions performed by subscriber-level users. Monitor logs for unusual activity from low-privilege accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with basic access to gain admin privileges, potentially taking control of the WordPress site. It may also be targeted in mass-exploit campaigns, increasing the risk of widespread attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the Patchstack mitigation rule to block attacks. Update the plugin to the latest version if available. Contact your hosting provider or developer for assistance. Restrict subscriber-level access to sensitive functions until patched.

Useful 0 Not Useful 0