{"id":"CVE-2026-42705","published":"2026-10-10T20:16:35.917","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Broken Access Control in Grand News <= 3.4 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/grandnews/vulnerability/wordpress-grand-news-theme-3-4-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Grand News plugin has a broken access control vulnerability that allows unauthenticated users to modify content and settings, potentially leading to unauthorized changes in the WordPress site's configuration and content.","exploitability":"Exploitation is straightforward with no authentication required, though it may depend on the specific version of Grand News being used.","blast_radius":"If exploited, attackers could modify news articles, change site settings, and potentially gain persistent access through content injection or configuration changes.","remediation":"Upgrade to Grand News version 3.5 or later to address this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","wordpress","plugin","content-modification"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:13.195Z"}}