CVE-2026-108480

8.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Unauthenticated remote attackers can access sensitive data and make unauthorized modifications without any prior access or interaction. They only need network connectivity to the target WordPress site.

Root cause

The plugin fails to perform required authorization checks on sensitive functions, allowing access controls to be bypassed.

Affected systems

Skydropx WordPress plugin through version 2.1.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Fix & remediation

Upgrade to a version newer than 2.1.4 if available, or deactivate and remove the Skydropx plugin until a patch is released.

shell

$ wp plugin deactivate skydropx

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.

References

https://patchstack.com/database/wordpress/plugin/skydropx/vulnerability/wordpress-skydropx-plugin-2-1-4-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108480