CVE-2026-111396

7.1High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-862

Impact

Authenticated attackers with low-privilege accounts can modify unauthorized settings and disrupt plugin availability over the network. They need valid credentials to the target WordPress site to exploit the missing access controls.

Root cause

The plugin fails to perform authorization checks, allowing authenticated users with inadequate permissions to execute restricted management functions.

Affected systems

Liquid Web / StellarWP Advanced Post Manager through 4.5.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Fix & remediation

Upgrade to a version higher than 4.5.6 if available; if no patched release exists yet, deactivate the plugin until an update is published.

shell

$ wp plugin deactivate advanced-post-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.

References

https://patchstack.com/database/wordpress/plugin/advanced-post-manager/vulnerability/wordpress-advanced-post-manager-plugin-4-5-6-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-111396