CVE-2026-62035

Received Received - Intake

Subscriber Broken Access Control in Upcasted WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-62035

EUVD

EUVD-2026-96470

Affected Vendors & Products

Vendor	Product	Version / Range
upcasted	AWS	S3 for WordPress Plugin – Upcasted n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-62035 is a Broken Access Control vulnerability in the WordPress AWS S3 for WordPress Plugin – Upcasted affecting versions 3.1.0 and below. It allows users with limited privileges, such as Subscribers, to access restricted pages or perform unauthorized actions, potentially viewing sensitive data belonging to other users.

Detection Guidance

To detect this vulnerability, check if the Upcasted AWS S3 for WordPress Plugin version is 3.1.0 or below. Log in to your WordPress admin panel and navigate to Plugins to verify the installed version. If the version is outdated, the system is vulnerable.

Impact Analysis

This vulnerability could allow unauthorized users to access sensitive data of other users, such as files stored in AWS S3 via the plugin. Attackers with Subscriber-level access might exploit this to view or manipulate restricted content.

Mitigation Strategies

Immediately update the Upcasted AWS S3 for WordPress Plugin to the latest version if available. If no patch exists, consider disabling the plugin temporarily or contacting your hosting provider or developer for assistance. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-62035. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70