{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28071", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-25T12:13:39.591Z", "datePublished": "2026-03-05T05:54:20.538Z", "dateUpdated": "2026-04-28T17:39:56.102Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "pixfort-core", "product": "pixfort Core", "vendor": "PixFort", "versions": [{"changes": [{"at": "3.2.26", "status": "unaffected"}], "lessThanOrEqual": "3.2.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Rafie Muhammad | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:06:09.109Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects pixfort Core: from n/a through <= 3.2.22.</p>"}], "value": "Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pixfort Core: from n/a through <= 3.2.22."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:06.967Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/pixfort-core/vulnerability/wordpress-pixfort-core-plugin-3-2-22-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T20:42:18.124293Z", "id": "CVE-2026-28071", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T17:39:56.102Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28071", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T20:42:18.124293Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T20:41:25.867Z"}}], "cna": {"title": "WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Rafie Muhammad | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PixFort", "product": "pixfort Core", "versions": [{"status": "affected", "changes": [{"at": "3.2.26", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.2.22"}], "packageName": "pixfort-core", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:06:09.109Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/pixfort-core/vulnerability/wordpress-pixfort-core-plugin-3-2-22-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pixfort Core: from n/a through <= 3.2.22.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects pixfort Core: from n/a through <= 3.2.22.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:06.967Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28071", "state": "PUBLISHED", "dateUpdated": "2026-04-28T17:39:56.102Z", "dateReserved": "2026-02-25T12:13:39.591Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-05T05:54:20.538Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pixfort Core: from n/a through <= 3.2.22."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en PixFort pixfort Core pixfort-core permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a pixfort Core: desde n/a hasta &lt;= 3.2.22."}], "id": "CVE-2026-28071", "lastModified": "2026-04-22T21:27:27.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-05T06:16:41.027", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/pixfort-core/vulnerability/wordpress-pixfort-core-plugin-3-2-22-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.22]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.2.26,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pixfort Core", "source": "cna", "vendor": "PixFort"}, "product": "pixfort_core", "vendor": "pixfort"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T23:00:15.055307+00:00", "value": {"mitigation_remediation": ["Upgrade the PixFort pixfort Core plugin to version 3.2.23 or later if available.", "If no newer version is available, remove the plugin from the site or restrict its activation to administrator\u2011only accounts.", "Review and tighten the plugin\u2019s access control settings to ensure that only appropriate user roles can modify plugin data."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access to Plugin Functionality"}, "threat_synthesis": {"affected_systems": "The issue affects the PixFort pixfort Core WordPress plugin versions up to and including 3.2.22. Any site using these affected plugin versions is at risk.", "description_and_impact": "The vulnerability is a missing authorization flaw in the PixFort pixfort Core plugin that allows users to exploit incorrectly configured access control security levels. This flaw can enable an attacker to access, modify, or delete plugin settings or data without proper permissions, potentially leading to unauthorized data exposure or modification. The weakness is classified as CWE\u2011862, indicating an authorization error where the application fails to check whether the user has sufficient privileges to perform a request.", "risk_and_exploitability": "With a CVSS score of 6.3, the vulnerability is of medium severity. EPSS indicates a very low probability of exploitation (<1%). The vulnerability is not currently reported in the CISA KEV catalog. The attack is likely web\u2011based, requiring access to the WordPress admin interface; users with limited or improperly scoped roles could potentially reach privileged plugin endpoints and exploit the missing authorization check. The impact is confined to plugin data rather than system-wide compromise, but can still lead to unauthorized data changes or disclosures."}}}}, "created": "2026-03-06T15:08:57.226036+00:00", "updated": "2026-04-15T23:15:17.743964+00:00", "vendors": ["pixfort", "pixfort$PRODUCT$pixfort_core", "wordpress", "wordpress$PRODUCT$wordpress"]}