{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25314", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:20:47.810Z", "datePublished": "2026-02-19T08:26:54.126Z", "dateUpdated": "2026-04-28T16:14:54.599Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "top-table-of-contents", "product": "TOP Table Of Contents", "vendor": "WP Messiah", "versions": [{"changes": [{"at": "1.4.0", "status": "unaffected"}], "lessThanOrEqual": "1.3.31", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:03.046Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects TOP Table Of Contents: from n/a through <= 1.3.31.</p>"}], "value": "Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TOP Table Of Contents: from n/a through <= 1.3.31."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:54.599Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/top-table-of-contents/vulnerability/wordpress-top-table-of-contents-plugin-1-3-31-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:35:52.813741Z", "id": "CVE-2026-25314", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:54:47.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25314", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T21:35:52.813741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:35:33.583Z"}}], "cna": {"title": "WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WP Messiah", "product": "TOP Table Of Contents", "versions": [{"status": "affected", "changes": [{"at": "1.4.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.31"}], "packageName": "top-table-of-contents", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:38.705Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/top-table-of-contents/vulnerability/wordpress-top-table-of-contents-plugin-1-3-31-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TOP Table Of Contents: from n/a through <= 1.3.31.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects TOP Table Of Contents: from n/a through <= 1.3.31.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:48.786Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25314", "state": "PUBLISHED", "dateUpdated": "2026-04-28T12:54:47.709Z", "dateReserved": "2026-02-02T12:20:47.810Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:26:54.126Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TOP Table Of Contents: from n/a through <= 1.3.31."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en WP Messiah TOP Table Of Contents top-table-of-contents permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a TOP Table Of Contents: desde n/a hasta &lt;= 1.3.31."}], "id": "CVE-2026-25314", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-02-19T09:16:15.633", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/top-table-of-contents/vulnerability/wordpress-top-table-of-contents-plugin-1-3-31-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.31]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[1.4.0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "TOP Table Of Contents", "source": "cna", "vendor": "WP Messiah"}, "product": "top_table_of_contents", "vendor": "wp_messiah"}], "analysis": {"en": {"generated_at": "2026-04-16T00:32:44.943464+00:00", "value": {"mitigation_remediation": ["Upgrade the TOP Table Of Contents plugin to version 1.3.32 or later, which contains the authorization fix", "Restrict plugin access by limiting the plugin\u2019s administrative pages to trusted users only, if the plugin provides such a setting", "Continuously monitor the WordPress admin area for unexpected changes to plugin configuration or privileged actions"], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access to Plugin Configuration"}, "threat_synthesis": {"affected_systems": "WordPress sites that run the WP Messiah TOP Table Of Contents plugin version 1.3.31 or earlier are affected. All releases up to 1.3.31, including any prior versions, are susceptible. Site administrators who rely on this plugin for table of contents management may be at risk.", "description_and_impact": "The vulnerability is a missing authorization flaw that allows an attacker to perform actions within the TOP Table Of Contents plugin that should be restricted. This breaks the intended access control, enabling an attacker to modify plugin settings or other privileged data. The weakness is identified as CWE-862 (Missing Authorization).", "risk_and_exploitability": "The CVSS score of 4.3 indicates a medium impact, and the EPSS score of less than 1% suggests that, at the time of analysis, exploitation is unlikely to be widespread. The vulnerability is not listed in the KEV catalog. The likely attack vector is through the normal web interface that the plugin exposes; an attacker with access to the site\u2019s front\u2011end or who can send crafted requests may exploit the missing authorization check. No additional conditions such as local privilege escalation or privileged user context are specified in the available data."}}}}, "created": "2026-02-20T10:09:08.190657+00:00", "updated": "2026-04-16T00:45:15.961228+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wp_messiah", "wp_messiah$PRODUCT$top_table_of_contents"]}