Dashboard / CVE-2026-113584

CVE-2026-113584

CRITICAL
INFO Priority: 0.02 BB Relevance: 80/100
Published: 2026-11-06 Modified: 2026-11-06 First seen: 2026-11-06 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown placester 0
Unknown placester 0

References & Advisories (1)

Bug Bounty Relevance

80 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.19%
Raw Score 0.001860
Percentile 8.3%
Date 2026-11-06

Intelligence Sources

mitre ref →
nvd ref →

External Links