{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27344", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-19T09:51:35.297Z", "datePublished": "2026-03-05T05:53:53.188Z", "dateUpdated": "2026-04-28T16:15:02.137Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "inseri-core", "product": "inseri core", "vendor": "inseriswiss", "versions": [{"lessThanOrEqual": "1.0.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "PPzzAArr | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:19:10.253Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects inseri core: from n/a through <= 1.0.5.</p>"}], "value": "Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:02.137Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/inseri-core/vulnerability/wordpress-inseri-core-plugin-1-0-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T20:41:26.066911Z", "id": "CVE-2026-27344", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T16:00:40.421Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27344", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-19T09:51:35.297Z", "datePublished": "2026-03-05T05:53:53.188Z", "dateUpdated": "2026-04-28T16:00:40.421Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "inseri-core", "product": "inseri core", "vendor": "inseriswiss", "versions": [{"lessThanOrEqual": "1.0.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "PPzzAArr | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:19:10.253Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects inseri core: from n/a through <= 1.0.5.</p>"}], "value": "Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:10.800Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/inseri-core/vulnerability/wordpress-inseri-core-plugin-1-0-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27344", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T20:41:26.066911Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T20:58:01.289Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en inseriswiss inseri core inseri-core permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a inseri core: desde n/a hasta &lt;= 1.0.5."}], "id": "CVE-2026-27344", "lastModified": "2026-04-28T19:37:15.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-03-05T06:16:25.020", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/inseri-core/vulnerability/wordpress-inseri-core-plugin-1-0-3-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "inseri core", "source": "cna", "vendor": "inseriswiss"}, "product": "inseri_core", "vendor": "inseriswiss"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T17:32:25.325629+00:00", "value": {"mitigation_remediation": ["Update the inseri core plugin to a version newer than 1.0.5 which removes the broken access control logic.", "If the plugin is not essential, uninstall or disable it to eliminate the attack surface.", "Review and adjust user role permissions in WordPress, ensuring that no user or role has unnecessary rights to the plugin\u2019s protected functions."], "summary": {"action": "Update Plugin", "impact": "Broken Access Control allowing unauthorized access to plugin functionality"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts WordPress environments that have the inseriswiss inseri core plugin of version 1.0.5 or earlier deployed. It affects all installations that have inserted this plugin, regardless of other configuration settings and regardless of top-level WordPress version, since the plugin itself is the source of the control failure.", "description_and_impact": "A missing authorization flaw in the inseri core plugin subverts the intended access control checks, enabling users who should not have permission to gain access to privileged functionality within the WordPress site. This weakness is classified as Authorization Bypass (CWE-862) and allows an attacker to bypass security policies that protect sensitive actions or data handled by the plugin.", "risk_and_exploitability": "The CVSS score of 5.9 indicates a moderate severity level. The EPSS score of less than 1% suggests that the exploitation probability is low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack path most likely requires web-based interaction with the vulnerable plugin\u2019s endpoints, potentially after authenticating as a legitimate user whose role does not ordinarily grant the sensitive capabilities exposed by the plugin. Exploitation would involve accessing URLs or API calls that are protected by the plugin\u2019s broken authorization checks, thereby gaining access to actions or data that should be restricted."}}}}, "created": "2026-03-06T15:13:33.659587+00:00", "updated": "2026-04-28T17:45:16.114447+00:00", "vendors": ["inseriswiss", "inseriswiss$PRODUCT$inseri_core", "wordpress", "wordpress$PRODUCT$wordpress"]}