CVE-2026-1984

Received Received - Intake

Unauthorized Post Meta Modification in Ibtana Ecommerce Product Addons

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-1984

Affected Vendors & Products

Vendor	Product	Version / Range
ibtana	ecommerce_product_addons	to 0.4.7.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Ibtana – Ecommerce Product Addons WordPress plugin has a vulnerability due to missing capability checks on the 'iepa_use_gt_editor' AJAX action. This allows authenticated attackers with Subscriber-level access or higher to modify or delete arbitrary post meta entries via the 'iepa_builder' meta key.

Detection Guidance

This vulnerability can be detected by checking for unauthorized post meta modifications via the 'iepa_use_gt_editor' AJAX action. Look for suspicious activity in WordPress logs or database entries with the 'iepa_builder' meta key. No specific commands are provided in the context.

Impact Analysis

An attacker could alter or delete important post metadata, potentially disrupting website functionality or compromising data integrity. This could lead to unauthorized changes in product information, pricing, or other critical ecommerce details.

Compliance Impact

This vulnerability may lead to unauthorized data modifications, which could violate integrity requirements under GDPR and HIPAA. Unauthorized changes to ecommerce data might result in non-compliance with data accuracy and protection standards.

Mitigation Strategies

Immediately update the Ibtana – Ecommerce Product Addons plugin to the latest version beyond 0.4.7.7. If an update is unavailable, consider disabling the plugin or restricting access to the 'iepa_use_gt_editor' AJAX action via server-side rules.

Hi! I’m here to help you understand CVE-2026-1984. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70