{"id":"CVE-2026-39796","published":"2026-10-06T09:17:52.697","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/advanced-posts-listing/vulnerability/wordpress-advanced-posts-listing-show-post-list-easily-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Advanced Posts Listing plugin allows unauthenticated users to bypass access controls and view restricted post listings, potentially exposing sensitive content to unauthorized users.","exploitability":"Exploitation is straightforward with no authentication required, making it highly accessible to attackers who can simply access the affected endpoint without any preconditions.","blast_radius":"The impact could be significant as attackers may gain access to private or draft posts, potentially exposing confidential information, internal communications, or unpublished content to unauthorized users across the entire WordPress site.","remediation":"Upgrade to version 1.0.9 or later which contains the fix for the broken access control vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","wordpress","plugin","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:07:13.150Z"}}