{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27362", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-19T09:51:48.838Z", "datePublished": "2026-03-05T05:53:54.793Z", "dateUpdated": "2026-04-28T16:15:02.484Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected", "packageName": "vc-autoresponder-addon", "product": "WP Bakery Autoresponder Addon", "vendor": "kamleshyadav", "versions": [{"lessThanOrEqual": "1.0.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:19:44.125Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.</p>"}], "value": "Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:02.484Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/vc-autoresponder-addon/vulnerability/wordpress-wp-bakery-autoresponder-addon-plugin-1-0-6-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T19:01:21.116037Z", "id": "CVE-2026-27362", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T16:02:00.603Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27362", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-19T09:51:48.838Z", "datePublished": "2026-03-05T05:53:54.793Z", "dateUpdated": "2026-04-28T16:02:00.603Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected", "packageName": "vc-autoresponder-addon", "product": "WP Bakery Autoresponder Addon", "vendor": "kamleshyadav", "versions": [{"lessThanOrEqual": "1.0.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:19:44.125Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.</p>"}], "value": "Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:10.799Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/vc-autoresponder-addon/vulnerability/wordpress-wp-bakery-autoresponder-addon-plugin-1-0-6-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27362", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T19:01:21.116037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T19:01:07.016Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a WP Bakery Autoresponder Addon: desde n/a hasta &lt;= 1.0.6."}], "id": "CVE-2026-27362", "lastModified": "2026-04-28T19:37:15.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-03-05T06:16:26.083", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/vc-autoresponder-addon/vulnerability/wordpress-wp-bakery-autoresponder-addon-plugin-1-0-6-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WP Bakery Autoresponder Addon", "source": "cna", "vendor": "kamleshyadav"}, "product": "wp_bakery_autoresponder_addon", "vendor": "kamleshyadav"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T23:37:12.312372+00:00", "value": {"mitigation_remediation": ["Update the WP Bakery Autoresponder Addon plugin to the latest available release if a security fix has been issued.", "If an update is not available, disable or remove the plugin from the WordPress installation to eliminate the vulnerability surface.", "Review WordPress user roles and permissions to ensure that only legitimate administrators have access to plugin configuration pages and data."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation via Missing Authorization"}, "threat_synthesis": {"affected_systems": "The affected product is the WP Bakery Autoresponder Addon plugin developed by kamleshyadav. All installed copies of the plugin with versions up to and including\u202f1.0.6 are impacted. No other versions or vendors are listed as affected in the current advisory.", "description_and_impact": "This vulnerability is a Missing Authorization flaw in the WP Bakery Autoresponder Addon plugin for WordPress. The plugin\u2019s access controls are incorrectly set, allowing users to perform actions beyond their intended scope. An attacker who can interact with the plugin\u2019s interfaces could gain elevated privileges, potentially taking full control of the affected WordPress site. The weakness is categorized as CWE\u2011862, representing an explicit missing authorization failure.", "risk_and_exploitability": "The advisory assigns a CVSS score of 6.5, indicating a medium severity vulnerability. The EPSS score is reported as less than 1%, implying a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits have been reported. Based on the description, the likely attack vector involves interacting with the plugin\u2019s exposed endpoints or administrative UI within a WordPress deployment, so an attacker would need access to run or craft requests against the web application."}}}}, "created": "2026-03-06T15:13:26.650509+00:00", "updated": "2026-04-15T23:45:05.917209+00:00", "vendors": ["kamleshyadav", "kamleshyadav$PRODUCT$wp_bakery_autoresponder_addon", "wordpress", "wordpress$PRODUCT$wordpress"]}