{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-105974", "aliases": [], "title": "Visual Form Builder：脆弱性情報", "summary": "Visual Form Builder プラグイン（バージョン 3.1 以下）は、ダッシュボードウィジェットで最近のフォーム送信データを表示する際に認可チェックを行わないため、認証済みユーザー（Subscriber 以上）は他のユーザーが送信した名前、メールアドレス、フォームタイトル、タイムスタンプといった連絡先情報を読むことができます。", "risk": "他のユーザーが送信した連絡先情報が閲覧できてしまう情報漏洩が発生します。", "product": "Visual Form Builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Visual Form Builder", "range": "<= 3.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-105974", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/ab69c0b2-e18d-495c-b6a3-546f4fe4c5d9/", "label": "contact@wpscan.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105974", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T06:00:13.926Z", "modifiedAt": "2026-10-16T15:17:04.523Z", "fetchedAt": "2026-10-23T02:43:42.047Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.", "sourceTitle": "Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Visual Form Builder", "versions": [ { "status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "3.1" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-105974", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "fetchedAt": "2026-10-23T02:43:42.047Z", "publishedAt": "2026-10-16T06:00:13.926Z", "modifiedAt": "2026-10-16T14:49:21.253Z", "state": "published", "provider": "WPScan", "title": "Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget", "descriptions": [ { "lang": "en", "value": "The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Unknown", "product": "Visual Form Builder", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "CWE-200 Information Exposure", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wpscan.com/vulnerability/ab69c0b2-e18d-495c-b6a3-546f4fe4c5d9/", "label": "WPScan", "tags": [ "exploit", "vdb-entry", "technical-description" ], "provider": "WPScan", "sourcePath": "/containers/cna/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Unknown\",\"product\":\"Visual Form Builder\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"3.1\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-200 Information Exposure\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":4.3,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"LOW\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:49:21.253Z", "fetchedAt": "2026-10-23T02:43:42.047Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:04.523Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Visual Form Builderに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:31.843Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d1097d6d67f84f14ee45265dd0a8fcbbc8cf0f750794cca0340efdfaecc42bfb", "sourceModifiedAt": "2026-10-16T15:17:04.523Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Visual Form Builder プラグイン（バージョン 3.1 以下）は、ダッシュボードウィジェットで最近のフォーム送信データを表示する際に認可チェックを行わないため、認証済みユーザー（Subscriber 以上）は他のユーザーが送信した名前、メールアドレス、フォームタイトル、タイムスタンプといった連絡先情報を読むことができます。", "risk": "他のユーザーが送信した連絡先情報が閲覧できてしまう情報漏洩が発生します。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは Visual Form Builder である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "プラグインのバージョンが 3.1 以下である場合に影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "WordPress の管理画面のダッシュボードウィジェットに最近のフォーム送信データが表示される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "認証済みユーザーでロールが Subscriber 以上であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "プラグインは送信データを表示する際に認可チェックを行わない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Visual Form Builder。影響ありとして記載：3.1以下の版。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Visual Form Builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-105974", "https://wpscan.com/vulnerability/ab69c0b2-e18d-495c-b6a3-546f4fe4c5d9/", "https://nvd.nist.gov/vuln/detail/CVE-2026-105974" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-105974", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/ab69c0b2-e18d-495c-b6a3-546f4fe4c5d9/", "label": "contact@wpscan.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105974", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "sourceField": "/containers/cna/title", "excerpt": "Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105974.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Visual Form Builder\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"3.1\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-105974（Visual Form Builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは Visual Form Builder である。\n・プラグインのバージョンが 3.1 以下である場合に影響を受ける。\n・WordPress の管理画面のダッシュボードウィジェットに最近のフォーム送信データが表示される。\n・認証済みユーザーでロールが Subscriber 以上であること。\n・プラグインは送信データを表示する際に認可チェックを行わない。\n・公式の対象表：Visual Form Builder。影響ありとして記載：3.1以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-105974", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:31.843Z", "lastSuccess": "2026-10-23T03:20:31.843Z", "sourceCheckedAt": "2026-10-23T02:43:42.047Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-105973", "aliases": [], "title": "Visual Form Builder：脆弱性情報", "summary": "Visual Form Builder プラグイン（バージョン 3.1 以下）では、フォームフィールドの並び替え時に認可チェックや nonce チェックが行われないため、Subscriber 以上の権限を持つ認証済みユーザーがサイト上の任意のフォームのフィールド構造を変更でき、公開表示が永続的に壊れる可能性があります。", "risk": "フィールド構造が変更されると、フォームの公開表示が壊れ、訪問者が正しくフォームを利用できなくなる。", "product": "Visual Form Builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Visual Form Builder", "range": "<= 3.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-105973", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/", "label": "contact@wpscan.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105973", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T06:00:13.742Z", "modifiedAt": "2026-10-16T15:17:04.390Z", "fetchedAt": "2026-10-23T02:43:41.986Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.", "sourceTitle": "Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Visual Form Builder", "versions": [ { "status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "3.1" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-105973", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "fetchedAt": "2026-10-23T02:43:41.986Z", "publishedAt": "2026-10-16T06:00:13.742Z", "modifiedAt": "2026-10-16T14:49:21.422Z", "state": "published", "provider": "WPScan", "title": "Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization", "descriptions": [ { "lang": "en", "value": "The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Unknown", "product": "Visual Form Builder", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/", "label": "WPScan", "tags": [ "exploit", "vdb-entry", "technical-description" ], "provider": "WPScan", "sourcePath": "/containers/cna/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Unknown\",\"product\":\"Visual Form Builder\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"3.1\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-862 Missing Authorization\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":4.3,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"integrityImpact\":\"LOW\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"NONE\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:49:21.422Z", "fetchedAt": "2026-10-23T02:43:41.986Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:04.390Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Visual Form Builderに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:32.485Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bd606e5ed8369813717aa7a05856664da307ca5a55c997739f6b16035114dcd7", "sourceModifiedAt": "2026-10-16T15:17:04.390Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Visual Form Builder プラグイン（バージョン 3.1 以下）では、フォームフィールドの並び替え時に認可チェックや nonce チェックが行われないため、Subscriber 以上の権限を持つ認証済みユーザーがサイト上の任意のフォームのフィールド構造を変更でき、公開表示が永続的に壊れる可能性があります。", "risk": "フィールド構造が変更されると、フォームの公開表示が壊れ、訪問者が正しくフォームを利用できなくなる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象製品は WordPress 用 Visual Form Builder プラグインで、バージョン 3.1 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "影響を受ける操作は、認証済みユーザー（Subscriber 以上）の権限でフォームフィールドの並び替えを行うこと。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "並び替え処理に認可チェックや nonce チェックが実装されていない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Visual Form Builder。影響ありとして記載：3.1以下の版。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Visual Form Builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-105973", "https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/", "https://nvd.nist.gov/vuln/detail/CVE-2026-105973" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-105973", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/", "label": "contact@wpscan.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105973", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "sourceField": "/containers/cna/title", "excerpt": "Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105973.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Visual Form Builder\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"3.1\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-105973（Visual Form Builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は WordPress 用 Visual Form Builder プラグインで、バージョン 3.1 以下が影響を受ける。\n・影響を受ける操作は、認証済みユーザー（Subscriber 以上）の権限でフォームフィールドの並び替えを行うこと。\n・並び替え処理に認可チェックや nonce チェックが実装されていない。\n・公式の対象表：Visual Form Builder。影響ありとして記載：3.1以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-105973", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:32.485Z", "lastSuccess": "2026-10-23T03:20:32.485Z", "sourceCheckedAt": "2026-10-23T02:43:41.986Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-104755", "aliases": [], "title": "WP Compress – Instant Performance & Speed Optimization：権限の奪取", "summary": "WP Compress – Instant Performance & Speed Optimization プラグイン（バージョン 7.25.00 以下）は、認証されていない攻撃者が `comms` エンドポイントで `group`、`setting`、`value` パラメータを操作できる特権昇格の脆弱性があります。`wps_ic_comms::start_comms` がフロントエンドのすべてのリクエストにフックされ、呼び出し元が送信した `apikey` をプラグインに保存された API キーと比較するだけで、WordPress の権限チェックや nonce 検証を行いません。その後、検証されていない `group`、`setting`、`value` をそのまま `change_setting()` に渡し、`WPS_IC_SETTINGS` オプションに書き込みます。このため、攻撃者は任意の権限キーをプラグイン設定に書き込み、`wps_ic_users::checkAndAddCaps()` が任意の WordPress ロール（例: Subscriber）に `manage_wpc_settings` 権限を付与させ、プラグイン管理者と同等の制御を取得できます。必要な API キーは、認証不要の `wpc_send_critical_remote` AJAX アクションを通じて取得でき、外部のクリティカル CSS サービスから返された `apiResults` フィールドを利用して `initCritical()` がプラグインの API キーを `wp_send_json_success` 応答で返すため、WordPress にログインせずに攻撃が完結します。", "risk": "攻撃者はプラグインの設定を書き換えて任意のロールに `manage_wpc_settings` 権限を付与でき、プラグインの最適化、CDN、クリティカル CSS の設定を管理者と同等に操作できるようになります。", "product": "WP Compress – Instant Performance & Speed Optimization", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "WP Compress – Instant Performance & Speed Optimization", "range": "<= 7.25.00" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104755", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00&old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104755", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T06:41:04.957Z", "modifiedAt": "2026-10-16T15:17:03.683Z", "fetchedAt": "2026-10-23T02:43:41.739Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.", "sourceTitle": "WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "aresit", "product": "WP Compress – Instant Performance & Speed Optimization", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "7.25.00", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104755", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "fetchedAt": "2026-10-23T02:43:41.739Z", "publishedAt": "2026-10-16T06:41:04.957Z", "modifiedAt": "2026-10-16T15:09:38.262Z", "state": "published", "provider": "Wordfence", "title": "WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint", "descriptions": [ { "lang": "en", "value": "The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "aresit", "product": "WP Compress – Instant Performance & Speed Optimization", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "7.25.00", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00&old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"aresit\",\"product\":\"WP Compress – Instant Performance & Speed Optimization\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.25.00\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:38.262Z", "fetchedAt": "2026-10-23T02:43:41.739Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:03.683Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "WP Compress – Instant Performance & Speed Optimizationに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:32.728Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b3c4b591b482b829a711423adbeccfcc6c1540d1d56dfe8c03b18c370b416641", "sourceModifiedAt": "2026-10-16T15:17:03.683Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "WP Compress – Instant Performance & Speed Optimization プラグイン（バージョン 7.25.00 以下）は、認証されていない攻撃者が `comms` エンドポイントで `group`、`setting`、`value` パラメータを操作できる特権昇格の脆弱性があります。`wps_ic_comms::start_comms` がフロントエンドのすべてのリクエストにフックされ、呼び出し元が送信した `apikey` をプラグインに保存された API キーと比較するだけで、WordPress の権限チェックや nonce 検証を行いません。その後、検証されていない `group`、`setting`、`value` をそのまま `change_setting()` に渡し、`WPS_IC_SETTINGS` オプションに書き込みます。このため、攻撃者は任意の権限キーをプラグイン設定に書き込み、`wps_ic_users::checkAndAddCaps()` が任意の WordPress ロール（例: Subscriber）に `manage_wpc_settings` 権限を付与させ、プラグイン管理者と同等の制御を取得できます。必要な API キーは、認証不要の `wpc_send_critical_remote` AJAX アクションを通じて取得でき、外部のクリティカル CSS サービスから返された `apiResults` フィールドを利用して `initCritical()` がプラグインの API キーを `wp_send_json_success` 応答で返すため、WordPress にログインせずに攻撃が完結します。", "risk": "攻撃者はプラグインの設定を書き換えて任意のロールに `manage_wpc_settings` 権限を付与でき、プラグインの最適化、CDN、クリティカル CSS の設定を管理者と同等に操作できるようになります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "バージョン 7.25.00 以下のすべての WP Compress プラグインが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証されていない攻撃者でもこの脆弱性を利用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "`wps_ic_comms::start_comms` ディスパッチャはフロントエンドのすべてのリクエストにフックされます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "アクセス制御は、呼び出し元が送信した `apikey` パラメータを保存されたプラグイン API キーと比較するだけで、WordPress の権限チェックや nonce 検証は行われません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "`group`、`setting`、`value` パラメータは検証されずにそのまま `change_setting()` に渡されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "`change_setting()` はこれらのパラメータを `WPS_IC_SETTINGS` オプションに書き込みます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "任意の権限キーがプラグイン設定に書き込まれると、`wps_ic_users::checkAndAddCaps()` が任意のロールに `manage_wpc_settings` 権限を付与します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "必要な API キーは、認証不要の `wpc_send_critical_remote` AJAX アクションを通じて取得できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "`initCritical()` が外部クリティカル CSS サービスから返された `apiResults` フィールドを受け取り、プラグインの API キーを `wp_send_json_success` 応答で返します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：aresit / WP Compress – Instant Performance & Speed Optimization。影響ありとして記載：7.25.00以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「WP Compress – Instant Performance & Speed Optimization」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104755", "https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve", "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49", "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30", "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042", "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816", "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00&old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00", "https://nvd.nist.gov/vuln/detail/CVE-2026-104755" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104755", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00&old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104755", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "sourceField": "/containers/cna/title", "excerpt": "WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104755.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"aresit\",\"product\":\"WP Compress – Instant Performance & Speed Optimization\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.25.00\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104755（WP Compress – Instant Performance & Speed Optimization）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 7.25.00 以下のすべての WP Compress プラグインが影響を受けます。\n・認証されていない攻撃者でもこの脆弱性を利用できます。\n・`wps_ic_comms::start_comms` ディスパッチャはフロントエンドのすべてのリクエストにフックされます。\n・アクセス制御は、呼び出し元が送信した `apikey` パラメータを保存されたプラグイン API キーと比較するだけで、WordPress の権限チェックや nonce 検証は行われません。\n・`group`、`setting`、`value` パラメータは検証されずにそのまま `change_setting()` に渡されます。\n・`change_setting()` はこれらのパラメータを `WPS_IC_SETTINGS` オプションに書き込みます。\n・任意の権限キーがプラグイン設定に書き込まれると、`wps_ic_users::checkAndAddCaps()` が任意のロールに `manage_wpc_settings` 権限を付与します。\n・必要な API キーは、認証不要の `wpc_send_critical_remote` AJAX アクションを通じて取得できます。\n・`initCritical()` が外部クリティカル CSS サービスから返された `apiResults` フィールドを受け取り、プラグインの API キーを `wp_send_json_success` 応答で返します。\n・公式の対象表：aresit / WP Compress – Instant Performance & Speed Optimization。影響ありとして記載：7.25.00以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104755", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:32.728Z", "lastSuccess": "2026-10-23T03:20:32.728Z", "sourceCheckedAt": "2026-10-23T02:43:41.739Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-104730", "aliases": [], "title": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers：脆弱性情報", "summary": "Sunshine Photo Cart プラグイン（バージョン 3.7.4 以下）は、認証されていない攻撃者が 'key' パラメータを通じて送信した信頼できないデータを逆シリアライズさせることで、PHP オブジェクトインジェクションが可能になる脆弱性があります。", "risk": "この脆弱性自体には POP chain が含まれていないため、単独では影響がありませんが、サイトに POP chain を含む別のプラグインやテーマがインストールされている場合、攻撃者は任意のファイル削除や機密データ取得、コード実行などを行える可能性があります。", "product": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers", "category": "wordpress", "component": "plugin", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers", "range": "<= 3.7.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104730", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f6b29e-1678-486c-a955-23d9247af0b5?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L164", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-frontend.php#L195", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L186", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-image.php#L177", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744492%40sunshine-photo-cart&new=3744492%40sunshine-photo-cart", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104730", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T06:41:06.131Z", "modifiedAt": "2026-10-16T15:17:03.460Z", "fetchedAt": "2026-10-23T02:43:41.657Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.", "sourceTitle": "Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "sunshinephotocart", "product": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.7.4", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104730", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "fetchedAt": "2026-10-23T02:43:41.657Z", "publishedAt": "2026-10-16T06:41:06.131Z", "modifiedAt": "2026-10-16T14:21:49.208Z", "state": "published", "provider": "Wordfence", "title": "Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter", "descriptions": [ { "lang": "en", "value": "The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "sunshinephotocart", "product": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.7.4", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f6b29e-1678-486c-a955-23d9247af0b5?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L164", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-frontend.php#L195", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L186", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-image.php#L177", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744492%40sunshine-photo-cart&new=3744492%40sunshine-photo-cart", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"sunshinephotocart\",\"product\":\"Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.7.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-502 Deserialization of Untrusted Data\",\"cweId\":\"CWE-502\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:21:49.208Z", "fetchedAt": "2026-10-23T02:43:41.657Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:03.460Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographersに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:33.380Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8d479e488305ee2001a71b89b102c699cd83c803854763e620378a62641bc335", "sourceModifiedAt": "2026-10-16T15:17:03.460Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Sunshine Photo Cart プラグイン（バージョン 3.7.4 以下）は、認証されていない攻撃者が 'key' パラメータを通じて送信した信頼できないデータを逆シリアライズさせることで、PHP オブジェクトインジェクションが可能になる脆弱性があります。", "risk": "この脆弱性自体には POP chain が含まれていないため、単独では影響がありませんが、サイトに POP chain を含む別のプラグインやテーマがインストールされている場合、攻撃者は任意のファイル削除や機密データ取得、コード実行などを行える可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象製品は WordPress 用プラグイン「Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers」です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "影響を受けるバージョンは 3.7.4 以下のすべてのバージョンです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "攻撃者は認証されていない状態でリクエストを送信できる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃は 'key' パラメータ（または公開お気に入りページ）に対して、信頼できないデータを送信し逆シリアライズさせることで実行されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：sunshinephotocart / Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers。影響ありとして記載：3.7.4以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104730", "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f6b29e-1678-486c-a955-23d9247af0b5?source=cve", "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L164", "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-frontend.php#L195", "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L186", "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-image.php#L177", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744492%40sunshine-photo-cart&new=3744492%40sunshine-photo-cart", "https://nvd.nist.gov/vuln/detail/CVE-2026-104730" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104730", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f6b29e-1678-486c-a955-23d9247af0b5?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L164", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-frontend.php#L195", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L186", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-image.php#L177", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3744492%40sunshine-photo-cart&new=3744492%40sunshine-photo-cart", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104730", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "sourceField": "/containers/cna/title", "excerpt": "Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104730.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"sunshinephotocart\",\"product\":\"Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.7.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104730（Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は WordPress 用プラグイン「Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers」です。\n・影響を受けるバージョンは 3.7.4 以下のすべてのバージョンです。\n・攻撃者は認証されていない状態でリクエストを送信できる必要があります。\n・攻撃は 'key' パラメータ（または公開お気に入りページ）に対して、信頼できないデータを送信し逆シリアライズさせることで実行されます。\n・公式の対象表：sunshinephotocart / Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers。影響ありとして記載：3.7.4以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104730", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:33.380Z", "lastSuccess": "2026-10-23T03:20:33.380Z", "sourceCheckedAt": "2026-10-23T02:43:41.657Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-103696", "aliases": [], "title": "Mobile builder：データベースへの不正操作", "summary": "Mobile builder WordPress プラグイン（バージョン 1.4.2 以下）は、'delivery_id' パラメータを SQL 文に使用する前にサニタイズやエスケープを行わないため、認証されていないユーザーが WCFM Delivery アドオンを導入しているサイトに対して SQL インジェクション攻撃を実行できる。", "risk": "認証されていないユーザーが SQL インジェクション攻撃を実行できる。", "product": "Mobile builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.8, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "Mobile builder", "range": "<= 1.4.2" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103696", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/3f3df5b4-bcb0-4d18-bd5d-88ce5582cd47/", "label": "contact@wpscan.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103696", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T06:00:13.565Z", "modifiedAt": "2026-10-16T15:17:02.380Z", "fetchedAt": "2026-10-23T02:43:41.271Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.", "sourceTitle": "Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Mobile builder", "versions": [ { "status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "1.4.2" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103696", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "fetchedAt": "2026-10-23T02:43:41.271Z", "publishedAt": "2026-10-16T06:00:13.565Z", "modifiedAt": "2026-10-16T14:49:21.576Z", "state": "published", "provider": "WPScan", "title": "Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter", "descriptions": [ { "lang": "en", "value": "The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Unknown", "product": "Mobile builder", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.4.2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "CWE-89 SQL Injection", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wpscan.com/vulnerability/3f3df5b4-bcb0-4d18-bd5d-88ce5582cd47/", "label": "WPScan", "tags": [ "exploit", "vdb-entry", "technical-description" ], "provider": "WPScan", "sourcePath": "/containers/cna/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Unknown\",\"product\":\"Mobile builder\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"1.4.2\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-89 SQL Injection\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":6.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"MEDIUM\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"integrityImpact\":\"NONE\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:49:21.576Z", "fetchedAt": "2026-10-23T02:43:41.271Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.380Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Mobile builderにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:33.929Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f7709c20bd9efdfe72c3fd42adb94b7a4e0e17fd6eefbc6fcce4d97c004c512b", "sourceModifiedAt": "2026-10-16T15:17:02.380Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Mobile builder WordPress プラグイン（バージョン 1.4.2 以下）は、'delivery_id' パラメータを SQL 文に使用する前にサニタイズやエスケープを行わないため、認証されていないユーザーが WCFM Delivery アドオンを導入しているサイトに対して SQL インジェクション攻撃を実行できる。", "risk": "認証されていないユーザーが SQL インジェクション攻撃を実行できる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Mobile builder プラグインのバージョンが 1.4.2 以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "サイトに WCFM Delivery アドオンが導入されていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃者が認証されていない状態であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：Mobile builder。影響ありとして記載：1.4.2以下の版。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Mobile builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103696", "https://wpscan.com/vulnerability/3f3df5b4-bcb0-4d18-bd5d-88ce5582cd47/", "https://nvd.nist.gov/vuln/detail/CVE-2026-103696" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "label": "CVE：WPScan" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103696", "label": "CVE公式レコード" }, { "url": "https://wpscan.com/vulnerability/3f3df5b4-bcb0-4d18-bd5d-88ce5582cd47/", "label": "contact@wpscan.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103696", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "sourceField": "/containers/cna/title", "excerpt": "Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103696.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Unknown\",\"product\":\"Mobile builder\",\"versions\":[{\"status\":\"affected\",\"versionType\":\"semver\",\"version\":\"0\",\"lessThanOrEqual\":\"1.4.2\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103696（Mobile builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Mobile builder プラグインのバージョンが 1.4.2 以下であること。\n・サイトに WCFM Delivery アドオンが導入されていること。\n・攻撃者が認証されていない状態であること。\n・公式の対象表：Mobile builder。影響ありとして記載：1.4.2以下の版。個別に記されていない版の影響は、原資料でも未確定です。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103696", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:33.929Z", "lastSuccess": "2026-10-23T03:20:33.929Z", "sourceCheckedAt": "2026-10-23T02:43:41.271Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-96570", "aliases": [], "title": "Schema & Structured Data for WP & AMP：ブラウザー上での不正な処理", "summary": "Schema & Structured Data for WP & AMP プラグイン（バージョン 1.67 以下）は、認証されていない攻撃者が 'saswp_review_text' パラメータを通じて保存型クロスサイトスクリプティングを実行できる脆弱性があります。", "risk": "攻撃者が仕込んだ任意のウェブスクリプトが、ページを閲覧したユーザーのブラウザーで実行されます。", "product": "Schema & Structured Data for WP & AMP", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Schema & Structured Data for WP & AMP", "range": "<= 1.67" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-96570", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1285322f-be3a-4015-b96d-79589a0897c8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L258", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L159", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L1874", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L5158", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-service.php#L126", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-form.php#L170", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740790%40schema-and-structured-data-for-wp&new=3740790%40schema-and-structured-data-for-wp", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96570", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:18.814Z", "modifiedAt": "2026-10-16T15:17:37.590Z", "fetchedAt": "2026-10-23T02:43:53.369Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.", "sourceTitle": "Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "magazine3", "product": "Schema & Structured Data for WP & AMP", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.67", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-96570", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "fetchedAt": "2026-10-23T02:43:53.369Z", "publishedAt": "2026-10-16T05:30:18.814Z", "modifiedAt": "2026-10-16T14:39:05.295Z", "state": "published", "provider": "Wordfence", "title": "Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter", "descriptions": [ { "lang": "en", "value": "The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "magazine3", "product": "Schema & Structured Data for WP & AMP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.67", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1285322f-be3a-4015-b96d-79589a0897c8?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L258", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L159", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L1874", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L5158", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-service.php#L126", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-form.php#L170", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740790%40schema-and-structured-data-for-wp&new=3740790%40schema-and-structured-data-for-wp", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"magazine3\",\"product\":\"Schema & Structured Data for WP & AMP\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.67\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:05.295Z", "fetchedAt": "2026-10-23T02:43:53.369Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:37.590Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Schema & Structured Data for WP & AMPにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:33.938Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "13f1ea24659ba1d90c4907f1339ee56b094258b268b87e104c190d3340ad6a1e", "sourceModifiedAt": "2026-10-16T15:17:37.590Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Schema & Structured Data for WP & AMP プラグイン（バージョン 1.67 以下）は、認証されていない攻撃者が 'saswp_review_text' パラメータを通じて保存型クロスサイトスクリプティングを実行できる脆弱性があります。", "risk": "攻撃者が仕込んだ任意のウェブスクリプトが、ページを閲覧したユーザーのブラウザーで実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "バージョン 1.67 以下のすべてのリリースが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "プラグインは 'saswp_review_text' パラメータを介した保存型 XSS に脆弱です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "入力のサニタイズと出力エスケープが不十分です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "認証されていない攻撃者が任意のウェブスクリプトを注入できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "注入されたスクリプトは、ユーザーがそのページにアクセスしたときに実行されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "nonce が [saswp-reviews-form] ショートコードの HTML に公開されています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "任意の匿名訪問者がその nonce を取得できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "nonce が唯一の認可ゲートであるにもかかわらず、実質的に機能しません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：magazine3 / Schema & Structured Data for WP & AMP。影響ありとして記載：1.67以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Schema & Structured Data for WP & AMP」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-96570", "https://www.wordfence.com/threat-intel/vulnerabilities/id/1285322f-be3a-4015-b96d-79589a0897c8?source=cve", "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L258", "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L159", "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L1874", "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L5158", "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-service.php#L126", "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-form.php#L170", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740790%40schema-and-structured-data-for-wp&new=3740790%40schema-and-structured-data-for-wp", "https://nvd.nist.gov/vuln/detail/CVE-2026-96570" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-96570", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1285322f-be3a-4015-b96d-79589a0897c8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L258", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-admin.php#L159", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L1874", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/admin_section/common-function.php#L5158", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-service.php#L126", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.66/modules/reviews/class-saswp-reviews-form.php#L170", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740790%40schema-and-structured-data-for-wp&new=3740790%40schema-and-structured-data-for-wp", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96570", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "sourceField": "/containers/cna/title", "excerpt": "Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96570.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"magazine3\",\"product\":\"Schema & Structured Data for WP & AMP\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.67\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-96570（Schema & Structured Data for WP & AMP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 1.67 以下のすべてのリリースが影響を受けます。\n・プラグインは 'saswp_review_text' パラメータを介した保存型 XSS に脆弱です。\n・入力のサニタイズと出力エスケープが不十分です。\n・認証されていない攻撃者が任意のウェブスクリプトを注入できます。\n・注入されたスクリプトは、ユーザーがそのページにアクセスしたときに実行されます。\n・nonce が [saswp-reviews-form] ショートコードの HTML に公開されています。\n・任意の匿名訪問者がその nonce を取得できます。\n・nonce が唯一の認可ゲートであるにもかかわらず、実質的に機能しません。\n・公式の対象表：magazine3 / Schema & Structured Data for WP & AMP。影響ありとして記載：1.67以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-96570", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:33.938Z", "lastSuccess": "2026-10-23T03:20:33.938Z", "sourceCheckedAt": "2026-10-23T02:43:53.369Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" }, { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-95809", "aliases": [], "title": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights：ブラウザー上での不正な処理", "summary": "Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights プラグインは、'country_name' パラメータの入力サニタイズと出力エスケープが不十分なため、バージョン 1.9.2.1 までのすべてのバージョンで、認証されていない攻撃者が保存型 DOM ベースのクロスサイトスクリプティングを実行できる。ヒートマップ記録エンドポイントは nonce だけで保護され、任意の訪問者が公開された opti_behavior_refresh_nonces AJAX アクションから nonce を取得できるため、実質的な障壁がない。", "risk": "攻撃者が注入したスクリプトがページを閲覧したユーザーのブラウザーで実行され、任意の操作や情報漏洩が起こる可能性がある。", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "range": "<= 1.9.2.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95809", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c631593-4857-46c8-80b3-d028524cb86c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/assets/js/metabox-analytics.js#L668", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L2656", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L1603", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/includes/class-opti-behavior-heatmap-session.php#L369", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-post-metabox.php#L1498", "label": "security@wordfence.com" }, { "url": "https://plugins.svn.wordpress.org/opti-behavior/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95809", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:23.365Z", "modifiedAt": "2026-10-16T15:17:37.270Z", "fetchedAt": "2026-10-23T02:43:53.288Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.", "sourceTitle": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "optiuser", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.9.2.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-95809", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "fetchedAt": "2026-10-23T02:43:53.288Z", "publishedAt": "2026-10-16T05:30:23.365Z", "modifiedAt": "2026-10-16T14:39:04.367Z", "state": "published", "provider": "Wordfence", "title": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter", "descriptions": [ { "lang": "en", "value": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "optiuser", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.9.2.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c631593-4857-46c8-80b3-d028524cb86c?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/assets/js/metabox-analytics.js#L668", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L2656", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L1603", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/includes/class-opti-behavior-heatmap-session.php#L369", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-post-metabox.php#L1498", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.svn.wordpress.org/opti-behavior/", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"optiuser\",\"product\":\"Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.9.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.367Z", "fetchedAt": "2026-10-23T02:43:53.288Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:37.270Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insightsにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:35.181Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7d5937caeba7c34d27e0c6483d5a9f16ebec7fc77cbee79f7c50092399dcceae", "sourceModifiedAt": "2026-10-16T15:17:37.270Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights プラグインは、'country_name' パラメータの入力サニタイズと出力エスケープが不十分なため、バージョン 1.9.2.1 までのすべてのバージョンで、認証されていない攻撃者が保存型 DOM ベースのクロスサイトスクリプティングを実行できる。ヒートマップ記録エンドポイントは nonce だけで保護され、任意の訪問者が公開された opti_behavior_refresh_nonces AJAX アクションから nonce を取得できるため、実質的な障壁がない。", "risk": "攻撃者が注入したスクリプトがページを閲覧したユーザーのブラウザーで実行され、任意の操作や情報漏洩が起こる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights プラグインのバージョン 1.9.2.1 以下（1.9.2.1 を含む）である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃は認証されていない攻撃者でも実行可能である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "'country_name' ロケーションパラメータが入力サニタイズされていない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ヒートマップ記録エンドポイントは nonce だけで保護され、nonce は公開された opti_behavior_refresh_nonces AJAX アクションから任意の訪問者が取得できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：optiuser / Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights。影響ありとして記載：1.9.2.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-95809", "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c631593-4857-46c8-80b3-d028524cb86c?source=cve", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/assets/js/metabox-analytics.js#L668", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L2656", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L1603", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/includes/class-opti-behavior-heatmap-session.php#L369", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-post-metabox.php#L1498", "https://plugins.svn.wordpress.org/opti-behavior/", "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "https://nvd.nist.gov/vuln/detail/CVE-2026-95809" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95809", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c631593-4857-46c8-80b3-d028524cb86c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/assets/js/metabox-analytics.js#L668", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L2656", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L1603", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/includes/class-opti-behavior-heatmap-session.php#L369", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-post-metabox.php#L1498", "label": "security@wordfence.com" }, { "url": "https://plugins.svn.wordpress.org/opti-behavior/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95809", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "sourceField": "/containers/cna/title", "excerpt": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95809.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"optiuser\",\"product\":\"Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.9.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-95809（Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights プラグインのバージョン 1.9.2.1 以下（1.9.2.1 を含む）である。\n・攻撃は認証されていない攻撃者でも実行可能である。\n・'country_name' ロケーションパラメータが入力サニタイズされていない。\n・ヒートマップ記録エンドポイントは nonce だけで保護され、nonce は公開された opti_behavior_refresh_nonces AJAX アクションから任意の訪問者が取得できる。\n・公式の対象表：optiuser / Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights。影響ありとして記載：1.9.2.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-95809", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:35.181Z", "lastSuccess": "2026-10-23T03:20:35.181Z", "sourceCheckedAt": "2026-10-23T02:43:53.288Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" }, { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-95686", "aliases": [], "title": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights：ブラウザー上での不正な処理", "summary": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights プラグインは、'targetUrl' パラメータに対する入力サニタイズと出力エスケープが不十分なため、バージョン 1.9.2.1 までのすべてのバージョンで、認証されていない攻撃者が任意のウェブスクリプトを保存型 DOM ベースのクロスサイトスクリプティング（XSS）として注入できる脆弱性があります。攻撃者はトラッキングページ上で公開される nonce（optiBehaviorHeatmapConfig.nonce）を利用してペイロードを書き込むことができ、ユーザーがそのページを閲覧するとスクリプトが実行されます。", "risk": "ユーザーが攻撃者が注入したページを閲覧した際に、任意のウェブスクリプトが実行される可能性があります。", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "range": "<= 1.9.2.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95686", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6939d-d87a-47e5-979f-2cad021c6e81?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/assets/js/metabox-analytics.js#L553", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L1652", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L3455", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-post-metabox.php#L1389", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/public/class-opti-behavior-heatmap-frontend.php#L905", "label": "security@wordfence.com" }, { "url": "https://plugins.svn.wordpress.org/opti-behavior/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95686", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:21.426Z", "modifiedAt": "2026-10-16T15:17:37.160Z", "fetchedAt": "2026-10-23T02:43:53.214Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.", "sourceTitle": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "optiuser", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.9.2.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-95686", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "fetchedAt": "2026-10-23T02:43:53.214Z", "publishedAt": "2026-10-16T05:30:21.426Z", "modifiedAt": "2026-10-16T14:39:04.505Z", "state": "published", "provider": "Wordfence", "title": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter", "descriptions": [ { "lang": "en", "value": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "optiuser", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.9.2.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6939d-d87a-47e5-979f-2cad021c6e81?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/assets/js/metabox-analytics.js#L553", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L1652", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L3455", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-post-metabox.php#L1389", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/public/class-opti-behavior-heatmap-frontend.php#L905", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.svn.wordpress.org/opti-behavior/", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"optiuser\",\"product\":\"Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.9.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.505Z", "fetchedAt": "2026-10-23T02:43:53.214Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:37.160Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insightsにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:35.790Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2059387f8eda09fdbf583f5c0951d553ef91107ff604ae4fb82aa27041240838", "sourceModifiedAt": "2026-10-16T15:17:37.160Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights プラグインは、'targetUrl' パラメータに対する入力サニタイズと出力エスケープが不十分なため、バージョン 1.9.2.1 までのすべてのバージョンで、認証されていない攻撃者が任意のウェブスクリプトを保存型 DOM ベースのクロスサイトスクリプティング（XSS）として注入できる脆弱性があります。攻撃者はトラッキングページ上で公開される nonce（optiBehaviorHeatmapConfig.nonce）を利用してペイロードを書き込むことができ、ユーザーがそのページを閲覧するとスクリプトが実行されます。", "risk": "ユーザーが攻撃者が注入したページを閲覧した際に、任意のウェブスクリプトが実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは、Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights のバージョン 1.9.2.1 以下すべてです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "'targetUrl' パラメータが入力されても、十分なサニタイズやエスケープが行われません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は認証されていなくてもペイロードを書き込むことができます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ペイロードは ingest エンドポイントに送信され、公開されている nonce（optiBehaviorHeatmapConfig.nonce）だけで書き込みが可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "この脆弱性は保存型（Stored）であり、注入されたスクリプトはページに永続的に残ります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ユーザーが注入されたページにアクセスすると、任意のウェブスクリプトが実行されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：optiuser / Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights。影響ありとして記載：1.9.2.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-95686", "https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6939d-d87a-47e5-979f-2cad021c6e81?source=cve", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/assets/js/metabox-analytics.js#L553", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L1652", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L3455", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-post-metabox.php#L1389", "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/public/class-opti-behavior-heatmap-frontend.php#L905", "https://plugins.svn.wordpress.org/opti-behavior/", "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "https://nvd.nist.gov/vuln/detail/CVE-2026-95686" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95686", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6939d-d87a-47e5-979f-2cad021c6e81?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/assets/js/metabox-analytics.js#L553", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L1652", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-ajax-handler.php#L3455", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/admin/class-opti-behavior-heatmap-post-metabox.php#L1389", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.1/public/class-opti-behavior-heatmap-frontend.php#L905", "label": "security@wordfence.com" }, { "url": "https://plugins.svn.wordpress.org/opti-behavior/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95686", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "sourceField": "/containers/cna/title", "excerpt": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95686.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"optiuser\",\"product\":\"Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.9.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-95686（Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは、Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights のバージョン 1.9.2.1 以下すべてです。\n・'targetUrl' パラメータが入力されても、十分なサニタイズやエスケープが行われません。\n・攻撃者は認証されていなくてもペイロードを書き込むことができます。\n・ペイロードは ingest エンドポイントに送信され、公開されている nonce（optiBehaviorHeatmapConfig.nonce）だけで書き込みが可能です。\n・この脆弱性は保存型（Stored）であり、注入されたスクリプトはページに永続的に残ります。\n・ユーザーが注入されたページにアクセスすると、任意のウェブスクリプトが実行されます。\n・公式の対象表：optiuser / Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights。影響ありとして記載：1.9.2.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-95686", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:35.790Z", "lastSuccess": "2026-10-23T03:20:35.790Z", "sourceCheckedAt": "2026-10-23T02:43:53.214Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" }, { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-93767", "aliases": [], "title": "Tainacan：ファイルへの不正アクセス", "summary": "Tainacanプラグイン（バージョン1.3.0以下）では、認証済みのSubscriber以上のユーザーが 'guid' パラメータを操作することで、ディレクトリトラバーサルが可能となり、サーバー上の任意のファイルを読み取ることができる。ただし、サーバーに uploads/tainacan ディレクトリが存在しない場合に限り、realpath() が false を返してベースパスが空になるため、パスの制限チェックが無効になる。", "risk": "サーバー上の任意のファイルの内容が読み取られ、機密情報が漏洩する可能性がある。", "product": "Tainacan", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "Tainacan", "range": "<= 1.3.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93767", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L393", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L418", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L391", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L147", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3733197%40tainacan&new=3733197%40tainacan", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93767", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:22.312Z", "modifiedAt": "2026-10-16T16:22:43.780Z", "fetchedAt": "2026-10-23T02:43:52.938Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.", "sourceTitle": "Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "tainacan", "product": "Tainacan", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-93767", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "fetchedAt": "2026-10-23T02:43:52.938Z", "publishedAt": "2026-10-16T05:30:22.312Z", "modifiedAt": "2026-10-16T15:44:36.511Z", "state": "published", "provider": "Wordfence", "title": "Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter", "descriptions": [ { "lang": "en", "value": "The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "tainacan", "product": "Tainacan", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L393", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L418", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L391", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L147", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3733197%40tainacan&new=3733197%40tainacan", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"tainacan\",\"product\":\"Tainacan\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"cweId\":\"CWE-22\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:44:36.511Z", "fetchedAt": "2026-10-23T02:43:52.938Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:22:43.780Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Tainacanにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:36.333Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "75759525da0da2bd1ff62f4379312bf253fd8cb636b1720183271e6a8926f33e", "sourceModifiedAt": "2026-10-16T16:22:43.780Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Tainacanプラグイン（バージョン1.3.0以下）では、認証済みのSubscriber以上のユーザーが 'guid' パラメータを操作することで、ディレクトリトラバーサルが可能となり、サーバー上の任意のファイルを読み取ることができる。ただし、サーバーに uploads/tainacan ディレクトリが存在しない場合に限り、realpath() が false を返してベースパスが空になるため、パスの制限チェックが無効になる。", "risk": "サーバー上の任意のファイルの内容が読み取られ、機密情報が漏洩する可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Tainacanプラグイン（WordPress用）のバージョン1.3.0以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "影響を受けるバージョンは 1.3.0 を含むすべてのバージョンである。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "認証済みの攻撃者で、Subscriber（購読者）以上の権限を持つユーザーが利用できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃は 'guid' パラメータを介して実行される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "uploads/tainacan ディレクトリがサーバーに存在しない場合にのみ、realpath() が false を返し、ベースパスが空文字列になるため、パス制限チェックが機能しなくなる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：tainacan / Tainacan。影響ありとして記載：1.3.0以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Tainacan」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-93767", "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=cve", "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L393", "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L418", "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L391", "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L147", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3733197%40tainacan&new=3733197%40tainacan", "https://nvd.nist.gov/vuln/detail/CVE-2026-93767" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93767", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L393", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L418", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L391", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tainacan/tags/1.3.0/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php#L147", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3733197%40tainacan&new=3733197%40tainacan", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93767", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "sourceField": "/containers/cna/title", "excerpt": "Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This vulnerability is exploitable only when the uploads/tainacan directory does not exist on the server, as this condition causes realpath() to return false, collapsing the base path to an empty string and rendering the containment check ineffective.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93767.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"tainacan\",\"product\":\"Tainacan\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.3.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-93767（Tainacan）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Tainacanプラグイン（WordPress用）のバージョン1.3.0以下が影響を受ける。\n・影響を受けるバージョンは 1.3.0 を含むすべてのバージョンである。\n・認証済みの攻撃者で、Subscriber（購読者）以上の権限を持つユーザーが利用できる。\n・攻撃は 'guid' パラメータを介して実行される。\n・uploads/tainacan ディレクトリがサーバーに存在しない場合にのみ、realpath() が false を返し、ベースパスが空文字列になるため、パス制限チェックが機能しなくなる。\n・公式の対象表：tainacan / Tainacan。影響ありとして記載：1.3.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-93767", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:36.333Z", "lastSuccess": "2026-10-23T03:20:36.333Z", "sourceCheckedAt": "2026-10-23T02:43:52.938Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-89079", "aliases": [], "title": "Theme My Login：権限の奪取", "summary": "Theme My Login プラグイン（バージョン 7.2.1 以下）では、認証されていない攻撃者が WordPress のマルチサイト環境において、特定の設定が有効な場合に任意のユーザーのパスワードを変更できる脆弱性があります。プラグインがパスワード更新前にユーザーの本人確認を正しく行わないことが原因です。", "risk": "攻撃者がユーザーのパスワードを変更できるため、対象ユーザーのアカウントを乗っ取られる可能性があります。", "product": "Theme My Login", "category": "wordpress", "component": "plugin", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Theme My Login", "range": "<= 7.2.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89079", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89079", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:22.643Z", "modifiedAt": "2026-10-16T18:19:42.210Z", "fetchedAt": "2026-10-23T02:43:51.975Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.", "sourceTitle": "Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "jfarthing84", "product": "Theme My Login", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "7.2.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-89079", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "fetchedAt": "2026-10-23T02:43:51.975Z", "publishedAt": "2026-10-16T05:30:22.643Z", "modifiedAt": "2026-10-16T17:06:54.311Z", "state": "published", "provider": "Wordfence", "title": "Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter", "descriptions": [ { "lang": "en", "value": "The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "jfarthing84", "product": "Theme My Login", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "7.2.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"jfarthing84\",\"product\":\"Theme My Login\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T17:06:54.311Z", "fetchedAt": "2026-10-23T02:43:51.975Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T18:19:42.210Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Theme My Loginに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:36.358Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "acdeba0d1594e7fc1bb373aa8664ad9f6520b9966deda0ad64b8877f140f645d", "sourceModifiedAt": "2026-10-16T18:19:42.210Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Theme My Login プラグイン（バージョン 7.2.1 以下）では、認証されていない攻撃者が WordPress のマルチサイト環境において、特定の設定が有効な場合に任意のユーザーのパスワードを変更できる脆弱性があります。プラグインがパスワード更新前にユーザーの本人確認を正しく行わないことが原因です。", "risk": "攻撃者がユーザーのパスワードを変更できるため、対象ユーザーのアカウントを乗っ取られる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "WordPress のマルチサイト構成で Theme My Login プラグインを使用している場合に影響します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "影響を受けるバージョンは 7.2.1 以下（0 から 7.2.1 まで）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "公式の対象表：jfarthing84 / Theme My Login。影響ありとして記載：7.2.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Theme My Login」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-89079", "https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve", "https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login", "https://nvd.nist.gov/vuln/detail/CVE-2026-89079" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89079", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89079", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "sourceField": "/containers/cna/title", "excerpt": "Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89079.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"jfarthing84\",\"product\":\"Theme My Login\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-89079（Theme My Login）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPress のマルチサイト構成で Theme My Login プラグインを使用している場合に影響します。\n・影響を受けるバージョンは 7.2.1 以下（0 から 7.2.1 まで）です。\n・公式の対象表：jfarthing84 / Theme My Login。影響ありとして記載：7.2.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-89079", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:36.358Z", "lastSuccess": "2026-10-23T03:20:36.358Z", "sourceCheckedAt": "2026-10-23T02:43:51.975Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-89051", "aliases": [], "title": "Hide My WP Ghost – Security & Firewall：ブラウザー上での不正な処理", "summary": "WordPress 用プラグイン Hide My WP Ghost（バージョン 7.0.12 以下）に、'replaceHeadersAndTags' 関数で入力のサニタイズと出力エスケープが不十分なため、認証されていない攻撃者がコメント内容に任意のウェブスクリプトを埋め込むことができ、ユーザーがそのリンクをクリックするとスクリプトが実行されます。", "risk": "ユーザーが攻撃者が埋め込んだリンクをクリックした際に、任意のウェブスクリプトが実行され、ページ上で不正な処理が行われる可能性があります。", "product": "Hide My WP Ghost – Security & Firewall", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Hide My WP Ghost – Security & Firewall", "range": "<= 7.0.12" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89051", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94724ff1-d3a7-4d9d-9423-a0e795360c95?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3745418%40hide-my-wp%2Ftags%2F7.0.13&old=3726247%40hide-my-wp%2Ftags%2F7.0.12", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89051", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:25.377Z", "modifiedAt": "2026-10-16T15:17:33.813Z", "fetchedAt": "2026-10-23T02:43:51.971Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.", "sourceTitle": "Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "johndarrel", "product": "Hide My WP Ghost – Security & Firewall", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "7.0.12", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-89051", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "fetchedAt": "2026-10-23T02:43:51.971Z", "publishedAt": "2026-10-16T05:30:25.377Z", "modifiedAt": "2026-10-16T14:39:04.042Z", "state": "published", "provider": "Wordfence", "title": "Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "descriptions": [ { "lang": "en", "value": "The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "johndarrel", "product": "Hide My WP Ghost – Security & Firewall", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "7.0.12", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94724ff1-d3a7-4d9d-9423-a0e795360c95?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3745418%40hide-my-wp%2Ftags%2F7.0.13&old=3726247%40hide-my-wp%2Ftags%2F7.0.12", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"johndarrel\",\"product\":\"Hide My WP Ghost – Security & Firewall\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.0.12\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.042Z", "fetchedAt": "2026-10-23T02:43:51.971Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:33.813Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Hide My WP Ghost – Security & Firewallにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:38.801Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fa012c583fdadbd10e52e148fe67bb0462bb3b4dec37eca7b1bc0c7f2af611b9", "sourceModifiedAt": "2026-10-16T15:17:33.813Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "WordPress 用プラグイン Hide My WP Ghost（バージョン 7.0.12 以下）に、'replaceHeadersAndTags' 関数で入力のサニタイズと出力エスケープが不十分なため、認証されていない攻撃者がコメント内容に任意のウェブスクリプトを埋め込むことができ、ユーザーがそのリンクをクリックするとスクリプトが実行されます。", "risk": "ユーザーが攻撃者が埋め込んだリンクをクリックした際に、任意のウェブスクリプトが実行され、ページ上で不正な処理が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Hide My WP Ghost – Security & Firewall プラグインのバージョン 7.0.12 以下は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証されていない攻撃者がコメント内容を通じて任意のウェブスクリプトを注入できる条件があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：johndarrel / Hide My WP Ghost – Security & Firewall。影響ありとして記載：7.0.12以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Hide My WP Ghost – Security & Firewall」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-89051", "https://www.wordfence.com/threat-intel/vulnerabilities/id/94724ff1-d3a7-4d9d-9423-a0e795360c95?source=cve", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3745418%40hide-my-wp%2Ftags%2F7.0.13&old=3726247%40hide-my-wp%2Ftags%2F7.0.12", "https://nvd.nist.gov/vuln/detail/CVE-2026-89051" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89051", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94724ff1-d3a7-4d9d-9423-a0e795360c95?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3745418%40hide-my-wp%2Ftags%2F7.0.13&old=3726247%40hide-my-wp%2Ftags%2F7.0.12", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89051", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "sourceField": "/containers/cna/title", "excerpt": "Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89051.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"johndarrel\",\"product\":\"Hide My WP Ghost – Security & Firewall\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.0.12\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-89051（Hide My WP Ghost – Security & Firewall）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Hide My WP Ghost – Security & Firewall プラグインのバージョン 7.0.12 以下は影響を受けます。\n・認証されていない攻撃者がコメント内容を通じて任意のウェブスクリプトを注入できる条件があります。\n・公式の対象表：johndarrel / Hide My WP Ghost – Security & Firewall。影響ありとして記載：7.0.12以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-89051", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:38.801Z", "lastSuccess": "2026-10-23T03:20:38.801Z", "sourceCheckedAt": "2026-10-23T02:43:51.971Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-88963", "aliases": [], "title": "Tutor LMS – eLearning and online course solution：ブラウザー上での不正な処理", "summary": "Tutor LMS – eLearning and online course solution プラグインは、バージョン4.0.8までに、'redirect_url' パラメータに対する入力検証が不十分で、Topbar コンポーネントの戻るボタンハンドラで DOM ベースのクロスサイトスクリプティングが可能になります。", "risk": "攻撃者が任意のウェブスクリプトを注入でき、被害者がそのページを閲覧したときにブラウザーでスクリプトが実行されます。", "product": "Tutor LMS – eLearning and online course solution", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.1, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "affected": [ { "product": "Tutor LMS – eLearning and online course solution", "range": "<= 4.0.8" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-88963", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f39a9570-a352-45f3-8644-2de2c1c709d2?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3700174%40tutor%2Ftags%2F4.0.9&old=3690454%40tutor%2Ftags%2F4.0.8", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3700174/tutor/trunk/assets/js/tutor-order-details.js", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88963", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:27.816Z", "modifiedAt": "2026-10-16T15:17:33.700Z", "fetchedAt": "2026-10-23T02:43:51.966Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.", "sourceTitle": "Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "themeum", "product": "Tutor LMS – eLearning and online course solution", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.0.8", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-88963", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "fetchedAt": "2026-10-23T02:43:51.966Z", "publishedAt": "2026-10-16T05:30:27.816Z", "modifiedAt": "2026-10-16T14:39:03.737Z", "state": "published", "provider": "Wordfence", "title": "Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter", "descriptions": [ { "lang": "en", "value": "The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "themeum", "product": "Tutor LMS – eLearning and online course solution", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.0.8", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f39a9570-a352-45f3-8644-2de2c1c709d2?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3700174%40tutor%2Ftags%2F4.0.9&old=3690454%40tutor%2Ftags%2F4.0.8", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/changeset/3700174/tutor/trunk/assets/js/tutor-order-details.js", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"themeum\",\"product\":\"Tutor LMS – eLearning and online course solution\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.8\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:03.737Z", "fetchedAt": "2026-10-23T02:43:51.966Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:33.700Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Tutor LMS – eLearning and online course solutionにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:39.882Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d7c90b4c9453bf80f89927c3d032ce89afb3b3d217bd36234d07d7287439b7e9", "sourceModifiedAt": "2026-10-16T15:17:33.700Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Tutor LMS – eLearning and online course solution プラグインは、バージョン4.0.8までに、'redirect_url' パラメータに対する入力検証が不十分で、Topbar コンポーネントの戻るボタンハンドラで DOM ベースのクロスサイトスクリプティングが可能になります。", "risk": "攻撃者が任意のウェブスクリプトを注入でき、被害者がそのページを閲覧したときにブラウザーでスクリプトが実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "未認証の攻撃者が 'redirect_url' パラメータを利用して任意のウェブスクリプトを注入できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "影響を受けるのは Tutor LMS プラグインのバージョン4.0.8までです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "問題は Topbar コンポーネントの戻るボタンハンドラにおける入力検証の不足です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "被害者が悪意のあるペイロードを含むページにアクセスしたときにスクリプトが実行されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：themeum / Tutor LMS – eLearning and online course solution。影響ありとして記載：4.0.8以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Tutor LMS – eLearning and online course solution」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-88963", "https://www.wordfence.com/threat-intel/vulnerabilities/id/f39a9570-a352-45f3-8644-2de2c1c709d2?source=cve", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3700174%40tutor%2Ftags%2F4.0.9&old=3690454%40tutor%2Ftags%2F4.0.8", "https://plugins.trac.wordpress.org/changeset/3700174/tutor/trunk/assets/js/tutor-order-details.js", "https://nvd.nist.gov/vuln/detail/CVE-2026-88963" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-88963", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f39a9570-a352-45f3-8644-2de2c1c709d2?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3700174%40tutor%2Ftags%2F4.0.9&old=3690454%40tutor%2Ftags%2F4.0.8", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3700174/tutor/trunk/assets/js/tutor-order-details.js", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88963", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "sourceField": "/containers/cna/title", "excerpt": "Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/88xxx/CVE-2026-88963.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"themeum\",\"product\":\"Tutor LMS – eLearning and online course solution\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.8\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-88963（Tutor LMS – eLearning and online course solution）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・未認証の攻撃者が 'redirect_url' パラメータを利用して任意のウェブスクリプトを注入できます。\n・影響を受けるのは Tutor LMS プラグインのバージョン4.0.8までです。\n・問題は Topbar コンポーネントの戻るボタンハンドラにおける入力検証の不足です。\n・被害者が悪意のあるペイロードを含むページにアクセスしたときにスクリプトが実行されます。\n・公式の対象表：themeum / Tutor LMS – eLearning and online course solution。影響ありとして記載：4.0.8以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-88963", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:39.882Z", "lastSuccess": "2026-10-23T03:20:39.882Z", "sourceCheckedAt": "2026-10-23T02:43:51.966Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-85659", "aliases": [], "title": "PilotPress：権限の奪取", "summary": "PilotPress プラグイン（WordPress 用）は、バージョン 2.0.43 までのすべてのバージョンで、認証済みの攻撃者（Subscriber 以上）が `username` パラメータを使ってアカウント取得を行い、管理者権限にエスカレーションできる脆弱性があります。AJAX ハンドラ `update_cc_details()` が攻撃者提供の `username` を ONTRAPORT に転送し、ローカルで `username_exists()` の衝突チェックを行った後にリモートのリネームをロールバックしないため、既存の WordPress 管理者のログイン名にリネームされたまま残ります。その後のログインで ONTRAPORT がリネームされたログインと攻撃者のパスワードで認証し、ローカルの管理者ユーザー行が取得されて `wp_set_password()` が実行され、攻撃者に管理者認証クッキーが発行されます。", "risk": "攻撃者は管理者アカウントを乗っ取り、フル管理者権限でサイトを操作できるようになります。", "product": "PilotPress", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "PilotPress", "range": "<= 2.0.43" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85659", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee48dd-72a7-49c3-90d5-7af1a30f9ecb?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L2380", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1690", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1029", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1099", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3737004", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85659", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:27.472Z", "modifiedAt": "2026-10-16T15:17:33.300Z", "fetchedAt": "2026-10-23T02:43:51.453Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.", "sourceTitle": "PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "ontraport", "product": "PilotPress", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "2.0.43", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-85659", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "fetchedAt": "2026-10-23T02:43:51.453Z", "publishedAt": "2026-10-16T05:30:27.472Z", "modifiedAt": "2026-10-16T14:28:39.370Z", "state": "published", "provider": "Wordfence", "title": "PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter", "descriptions": [ { "lang": "en", "value": "The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "ontraport", "product": "PilotPress", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.0.43", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee48dd-72a7-49c3-90d5-7af1a30f9ecb?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L2380", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1690", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1029", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1099", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3737004", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"ontraport\",\"product\":\"PilotPress\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.0.43\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:28:39.370Z", "fetchedAt": "2026-10-23T02:43:51.453Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:33.300Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "PilotPressに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:40.050Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b501b14d80fd9fc101c677ee861a0dd5fe270ab063677a7d6f871b4a83ba1e42", "sourceModifiedAt": "2026-10-16T15:17:33.300Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PilotPress プラグイン（WordPress 用）は、バージョン 2.0.43 までのすべてのバージョンで、認証済みの攻撃者（Subscriber 以上）が `username` パラメータを使ってアカウント取得を行い、管理者権限にエスカレーションできる脆弱性があります。AJAX ハンドラ `update_cc_details()` が攻撃者提供の `username` を ONTRAPORT に転送し、ローカルで `username_exists()` の衝突チェックを行った後にリモートのリネームをロールバックしないため、既存の WordPress 管理者のログイン名にリネームされたまま残ります。その後のログインで ONTRAPORT がリネームされたログインと攻撃者のパスワードで認証し、ローカルの管理者ユーザー行が取得されて `wp_set_password()` が実行され、攻撃者に管理者認証クッキーが発行されます。", "risk": "攻撃者は管理者アカウントを乗っ取り、フル管理者権限でサイトを操作できるようになります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証済みで Subscriber 以上の権限を持ち、かつ有効な ONTRAPORT コンタクトと Customer Center の nonce を保持しているユーザーが攻撃対象となります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "影響を受けるのは PilotPress のバージョン 2.0.43 まで（含む）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：ontraport / PilotPress。影響ありとして記載：2.0.43以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「PilotPress」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-85659", "https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee48dd-72a7-49c3-90d5-7af1a30f9ecb?source=cve", "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L2380", "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1690", "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1029", "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1099", "https://plugins.trac.wordpress.org/changeset/3737004", "https://nvd.nist.gov/vuln/detail/CVE-2026-85659" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85659", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee48dd-72a7-49c3-90d5-7af1a30f9ecb?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L2380", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1690", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1029", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1099", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3737004", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85659", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "sourceField": "/containers/cna/title", "excerpt": "PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85659.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"ontraport\",\"product\":\"PilotPress\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.0.43\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-85659（PilotPress）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証済みで Subscriber 以上の権限を持ち、かつ有効な ONTRAPORT コンタクトと Customer Center の nonce を保持しているユーザーが攻撃対象となります。\n・影響を受けるのは PilotPress のバージョン 2.0.43 まで（含む）です。\n・公式の対象表：ontraport / PilotPress。影響ありとして記載：2.0.43以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-85659", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:40.050Z", "lastSuccess": "2026-10-23T03:20:40.050Z", "sourceCheckedAt": "2026-10-23T02:43:51.453Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-12272", "aliases": [], "title": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent：情報の漏えい", "summary": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent プラグイン（WordPress 用）は、バージョン 1.19 までのすべてのバージョンで、W3TC_DYNAMIC_SECURITY 定数が公開された固定値としてハードコードされているため、認証されていない攻撃者が W3 Total Cache のセキュリティキーを知ることができ、W3 Total Cache がインストールされている環境では任意の PHP コードを注入できる可能性があります。", "risk": "攻撃者が W3 Total Cache のセキュリティキーを取得できるため、機密情報が漏洩し、さらに任意の PHP コードが実行される恐れがあります。", "product": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent", "range": "<= 1.19" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-12272", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/54e53420-aa89-49d6-9632-cba066c46a51?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3584811/lightweight-cookie-notice-free/trunk/public/class-daextlwcnf-public.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12272", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:22.999Z", "modifiedAt": "2026-10-16T18:17:57.243Z", "fetchedAt": "2026-10-23T02:43:45.925Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.", "sourceTitle": "Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "daext", "product": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.19", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-12272", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "fetchedAt": "2026-10-23T02:43:45.925Z", "publishedAt": "2026-10-16T05:30:22.999Z", "modifiedAt": "2026-10-16T17:06:46.117Z", "state": "published", "provider": "Wordfence", "title": "Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant", "descriptions": [ { "lang": "en", "value": "The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "daext", "product": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.19", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-330", "lang": "en", "description": "CWE-330 Use of Insufficiently Random Values", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/54e53420-aa89-49d6-9632-cba066c46a51?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/changeset/3584811/lightweight-cookie-notice-free/trunk/public/class-daextlwcnf-public.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"daext\",\"product\":\"Lightweight Cookie Notice – Cookie Banner for Cookie Consent\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.19\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-330 Use of Insufficiently Random Values\",\"cweId\":\"CWE-330\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T17:06:46.117Z", "fetchedAt": "2026-10-23T02:43:45.925Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T18:17:57.243Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Lightweight Cookie Notice – Cookie Banner for Cookie Consentに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:40.421Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "1078c411de1c294e302bc145708d1ffc03e83d4266207c558f1d590193766e52", "sourceModifiedAt": "2026-10-16T18:17:57.243Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent プラグイン（WordPress 用）は、バージョン 1.19 までのすべてのバージョンで、W3TC_DYNAMIC_SECURITY 定数が公開された固定値としてハードコードされているため、認証されていない攻撃者が W3 Total Cache のセキュリティキーを知ることができ、W3 Total Cache がインストールされている環境では任意の PHP コードを注入できる可能性があります。", "risk": "攻撃者が W3 Total Cache のセキュリティキーを取得できるため、機密情報が漏洩し、さらに任意の PHP コードが実行される恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインのバージョンが 1.19 以下（1.19 を含む）である場合に脆弱です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "W3 Total Cache プラグインが同じ WordPress 環境にインストールされていることが、コード注入が可能になる条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：daext / Lightweight Cookie Notice – Cookie Banner for Cookie Consent。影響ありとして記載：1.19以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Lightweight Cookie Notice – Cookie Banner for Cookie Consent」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-12272", "https://www.wordfence.com/threat-intel/vulnerabilities/id/54e53420-aa89-49d6-9632-cba066c46a51?source=cve", "https://plugins.trac.wordpress.org/changeset/3584811/lightweight-cookie-notice-free/trunk/public/class-daextlwcnf-public.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-12272" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-12272", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/54e53420-aa89-49d6-9632-cba066c46a51?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3584811/lightweight-cookie-notice-free/trunk/public/class-daextlwcnf-public.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12272", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "sourceField": "/containers/cna/title", "excerpt": "Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12272.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"daext\",\"product\":\"Lightweight Cookie Notice – Cookie Banner for Cookie Consent\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.19\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-12272（Lightweight Cookie Notice – Cookie Banner for Cookie Consent）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインのバージョンが 1.19 以下（1.19 を含む）である場合に脆弱です。\n・W3 Total Cache プラグインが同じ WordPress 環境にインストールされていることが、コード注入が可能になる条件です。\n・公式の対象表：daext / Lightweight Cookie Notice – Cookie Banner for Cookie Consent。影響ありとして記載：1.19以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-12272", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:40.421Z", "lastSuccess": "2026-10-23T03:20:40.421Z", "sourceCheckedAt": "2026-10-23T02:43:45.925Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-111122", "aliases": [], "title": "SiteOrigin CSS：ブラウザー上での不正な処理", "summary": "SiteOrigin CSSプラグインは、hrefパラメータの入力サニタイズと出力エスケープが不十分なため、バージョン1.6.7までのすべてのバージョンで、保存型DOMベースのクロスサイトスクリプティングが可能です。未認証の攻撃者がコメントに任意のウェブスクリプトを埋め込むことができ、ページが表示されるたびにそのスクリプトが実行されます。攻撃が成功するには、悪意あるコメントが承認され、管理者がVisual Inspectorを開いて攻撃者のアンカーリンクをクリックする必要があります。", "risk": "任意のウェブスクリプトが実行され、ページ閲覧者のブラウザで不正な処理が行われる可能性があります。", "product": "SiteOrigin CSS", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "SiteOrigin CSS", "range": "<= 1.6.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-111122", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97742c7c-4957-4597-9cc0-c9594e8c8482?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L280", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L276", "label": "security@wordfence.com" }, { "url": "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111122", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:25.740Z", "modifiedAt": "2026-10-16T15:17:13.390Z", "fetchedAt": "2026-10-23T02:43:45.158Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.", "sourceTitle": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "gpriday", "product": "SiteOrigin CSS", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.6.7", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-111122", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "fetchedAt": "2026-10-23T02:43:45.158Z", "publishedAt": "2026-10-16T05:30:25.740Z", "modifiedAt": "2026-10-16T14:39:03.885Z", "state": "published", "provider": "Wordfence", "title": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector", "descriptions": [ { "lang": "en", "value": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "gpriday", "product": "SiteOrigin CSS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.6.7", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97742c7c-4957-4597-9cc0-c9594e8c8482?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L280", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L276", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"gpriday\",\"product\":\"SiteOrigin CSS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.6.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:03.885Z", "fetchedAt": "2026-10-23T02:43:45.158Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:13.390Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "SiteOrigin CSSにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:40.593Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5023b7e2f1780a073ed67e339be41adf9c60497a373917e5db7d882c3c247eff", "sourceModifiedAt": "2026-10-16T15:17:13.390Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SiteOrigin CSSプラグインは、hrefパラメータの入力サニタイズと出力エスケープが不十分なため、バージョン1.6.7までのすべてのバージョンで、保存型DOMベースのクロスサイトスクリプティングが可能です。未認証の攻撃者がコメントに任意のウェブスクリプトを埋め込むことができ、ページが表示されるたびにそのスクリプトが実行されます。攻撃が成功するには、悪意あるコメントが承認され、管理者がVisual Inspectorを開いて攻撃者のアンカーリンクをクリックする必要があります。", "risk": "任意のウェブスクリプトが実行され、ページ閲覧者のブラウザで不正な処理が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "WordPressサイトにSiteOrigin CSSプラグインがインストールされていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "プラグインのバージョンが1.6.7以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "コメント機能が有効で、コメントが承認されるプロセスが存在すること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "管理者がVisual Inspectorを使用し、コメント内のアンカーリンクをクリックすること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：gpriday / SiteOrigin CSS。影響ありとして記載：1.6.7以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「SiteOrigin CSS」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-111122", "https://www.wordfence.com/threat-intel/vulnerabilities/id/97742c7c-4957-4597-9cc0-c9594e8c8482?source=cve", "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L280", "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L276", "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "https://nvd.nist.gov/vuln/detail/CVE-2026-111122" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-111122", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97742c7c-4957-4597-9cc0-c9594e8c8482?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L280", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.7/js/inspector.js#L276", "label": "security@wordfence.com" }, { "url": "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111122", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "sourceField": "/containers/cna/title", "excerpt": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111122.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"gpriday\",\"product\":\"SiteOrigin CSS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.6.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-111122（SiteOrigin CSS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPressサイトにSiteOrigin CSSプラグインがインストールされていること。\n・プラグインのバージョンが1.6.7以下であること。\n・コメント機能が有効で、コメントが承認されるプロセスが存在すること。\n・管理者がVisual Inspectorを使用し、コメント内のアンカーリンクをクリックすること。\n・公式の対象表：gpriday / SiteOrigin CSS。影響ありとして記載：1.6.7以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-111122", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:40.593Z", "lastSuccess": "2026-10-23T03:20:40.593Z", "sourceCheckedAt": "2026-10-23T02:43:45.158Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-110017", "aliases": [], "title": "Quick PayPal Payments: Payment Button & Form：ブラウザー上での不正な処理", "summary": "WordPress 用プラグイン「Quick PayPal Payments: Payment Button & Form」のバージョン 6.0.4 以下において、'form' パラメータの入力を十分にサニタイズ・エスケープしないため、認証済みの貢献者以上の権限を持つ攻撃者が任意のウェブスクリプトをページに埋め込める Stored Cross‑Site Scripting の脆弱性が存在します。wp_kses_post が除去するのは HTML タグだけで、角括弧（< >）を含まないクオート破壊型ペイロードは保存時にそのまま残り、ページを閲覧したすべてのユーザー（特に投稿をプレビューする編集者や管理者）でスクリプトが実行されます。", "risk": "埋め込まれたスクリプトが閲覧者のブラウザーで実行され、編集者や管理者など高権限ユーザーの操作が乗っ取られる可能性があります。", "product": "Quick PayPal Payments: Payment Button & Form", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Quick PayPal Payments: Payment Button & Form", "range": "<= 6.0.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110017", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/203f850e-1eed-4c49-b733-4ac2ce9b6772?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1546", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1554", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L603", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L826", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746507", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746507/quick-paypal-payments/trunk/legacy/quick-paypal-payments.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110017", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:19.662Z", "modifiedAt": "2026-10-16T15:17:09.230Z", "fetchedAt": "2026-10-23T02:43:44.095Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content.", "sourceTitle": "Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "fullworks", "product": "Quick PayPal Payments: Payment Button & Form", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "6.0.4", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-110017", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "fetchedAt": "2026-10-23T02:43:44.095Z", "publishedAt": "2026-10-16T05:30:19.662Z", "modifiedAt": "2026-10-16T14:39:04.958Z", "state": "published", "provider": "Wordfence", "title": "Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute", "descriptions": [ { "lang": "en", "value": "The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "fullworks", "product": "Quick PayPal Payments: Payment Button & Form", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "6.0.4", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/203f850e-1eed-4c49-b733-4ac2ce9b6772?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1546", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1554", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L603", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L826", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746507", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746507/quick-paypal-payments/trunk/legacy/quick-paypal-payments.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"fullworks\",\"product\":\"Quick PayPal Payments: Payment Button & Form\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"6.0.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.958Z", "fetchedAt": "2026-10-23T02:43:44.095Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:09.230Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Quick PayPal Payments: Payment Button & Formにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:41.650Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3c7d034aee258dafabf448c58dac94dbc401e4c0910c896e90548ed7a86fd99c", "sourceModifiedAt": "2026-10-16T15:17:09.230Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "WordPress 用プラグイン「Quick PayPal Payments: Payment Button & Form」のバージョン 6.0.4 以下において、'form' パラメータの入力を十分にサニタイズ・エスケープしないため、認証済みの貢献者以上の権限を持つ攻撃者が任意のウェブスクリプトをページに埋め込める Stored Cross‑Site Scripting の脆弱性が存在します。wp_kses_post が除去するのは HTML タグだけで、角括弧（< >）を含まないクオート破壊型ペイロードは保存時にそのまま残り、ページを閲覧したすべてのユーザー（特に投稿をプレビューする編集者や管理者）でスクリプトが実行されます。", "risk": "埋め込まれたスクリプトが閲覧者のブラウザーで実行され、編集者や管理者など高権限ユーザーの操作が乗っ取られる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは「Quick PayPal Payments: Payment Button & Form」プラグインのバージョン 6.0.4 以下すべてです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃を行えるのは、貢献者（Contributor）以上の権限を持つ認証済みユーザーです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：fullworks / Quick PayPal Payments: Payment Button & Form。影響ありとして記載：6.0.4以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Quick PayPal Payments: Payment Button & Form」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-110017", "https://www.wordfence.com/threat-intel/vulnerabilities/id/203f850e-1eed-4c49-b733-4ac2ce9b6772?source=cve", "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1546", "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1554", "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L603", "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L826", "https://plugins.trac.wordpress.org/changeset/3746507", "https://plugins.trac.wordpress.org/changeset/3746507/quick-paypal-payments/trunk/legacy/quick-paypal-payments.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-110017" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110017", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/203f850e-1eed-4c49-b733-4ac2ce9b6772?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1546", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L1554", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L603", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/quick-paypal-payments/tags/6.0.4/legacy/quick-paypal-payments.php#L826", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746507", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746507/quick-paypal-payments/trunk/legacy/quick-paypal-payments.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110017", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post strips only HTML tags, a quote-breaking payload containing no angle brackets survives post save intact, and the injected script fires for every viewer of the post — including higher-privileged Editors and Administrators who routinely preview a Contributor's pending content.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "sourceField": "/containers/cna/title", "excerpt": "Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110017.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"fullworks\",\"product\":\"Quick PayPal Payments: Payment Button & Form\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"6.0.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-110017（Quick PayPal Payments: Payment Button & Form）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは「Quick PayPal Payments: Payment Button & Form」プラグインのバージョン 6.0.4 以下すべてです。\n・攻撃を行えるのは、貢献者（Contributor）以上の権限を持つ認証済みユーザーです。\n・公式の対象表：fullworks / Quick PayPal Payments: Payment Button & Form。影響ありとして記載：6.0.4以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-110017", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:41.650Z", "lastSuccess": "2026-10-23T03:20:41.650Z", "sourceCheckedAt": "2026-10-23T02:43:44.095Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-109513", "aliases": [], "title": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar：ブラウザー上での不正な処理", "summary": "NotificationX プラグイン（バージョン 3.3.3 以下）は、'name' パラメータの入力を十分にサニタイズせず、出力時にエスケープしないため、認証されていない攻撃者が任意のウェブスクリプトを保存型クロスサイトスクリプティング（XSS）として注入できる脆弱性があります。このスクリプトは、攻撃者がページに埋め込んだ通知が表示されるページにユーザーがアクセスしたときに実行されます。なお、攻撃が成立するには、管理者が WordPress.org のレビューキャンペーンを有効化し、public ページに notificationx‑pro/notificationx 動的ブロックを配置している必要があります。", "risk": "攻撃者が注入したスクリプトがユーザーのブラウザーで実行され、ページ上で任意の処理が行われる可能性があります。", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "range": "<= 3.3.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109513", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cac6c4f3-ac60-45d6-a5ba-6708fc1491a4?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/blocks/Blocks.php#L218", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Features/ShortcodeInline.php#L148", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/WordPress/WPOrgReview.php#L295", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L55", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1119", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3746251%40notificationx%2Ftags%2F3.3.4&old=3720837%40notificationx%2Ftags%2F3.3.3", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109513", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:26.784Z", "modifiedAt": "2026-10-16T15:17:07.797Z", "fetchedAt": "2026-10-23T02:43:43.464Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.", "sourceTitle": "NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpdevteam", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.3.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109513", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "fetchedAt": "2026-10-23T02:43:43.464Z", "publishedAt": "2026-10-16T05:30:26.784Z", "modifiedAt": "2026-10-16T14:29:18.061Z", "state": "published", "provider": "Wordfence", "title": "NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route", "descriptions": [ { "lang": "en", "value": "The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpdevteam", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.3.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cac6c4f3-ac60-45d6-a5ba-6708fc1491a4?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/blocks/Blocks.php#L218", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Features/ShortcodeInline.php#L148", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/WordPress/WPOrgReview.php#L295", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L55", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1119", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3746251%40notificationx%2Ftags%2F3.3.4&old=3720837%40notificationx%2Ftags%2F3.3.3", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpdevteam\",\"product\":\"NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:29:18.061Z", "fetchedAt": "2026-10-23T02:43:43.464Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.797Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Barにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:42.148Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "42ba78ddc4b7043b5f9a64831ef13bcfd92a44e8b3bcaa6afd15bf293276d207", "sourceModifiedAt": "2026-10-16T15:17:07.797Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NotificationX プラグイン（バージョン 3.3.3 以下）は、'name' パラメータの入力を十分にサニタイズせず、出力時にエスケープしないため、認証されていない攻撃者が任意のウェブスクリプトを保存型クロスサイトスクリプティング（XSS）として注入できる脆弱性があります。このスクリプトは、攻撃者がページに埋め込んだ通知が表示されるページにユーザーがアクセスしたときに実行されます。なお、攻撃が成立するには、管理者が WordPress.org のレビューキャンペーンを有効化し、public ページに notificationx‑pro/notificationx 動的ブロックを配置している必要があります。", "risk": "攻撃者が注入したスクリプトがユーザーのブラウザーで実行され、ページ上で任意の処理が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "バージョン 3.3.3 以下のすべての NotificationX プラグインは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "管理者が WordPress.org の Reviews キャンペーンを有効化し、public ページに notificationx‑pro/notificationx 動的ブロックを配置している場合に限り、攻撃が可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "認証されていない攻撃者でもこの脆弱性を利用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wpdevteam / NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar。影響ありとして記載：3.3.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109513", "https://www.wordfence.com/threat-intel/vulnerabilities/id/cac6c4f3-ac60-45d6-a5ba-6708fc1491a4?source=cve", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/blocks/Blocks.php#L218", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Features/ShortcodeInline.php#L148", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/WordPress/WPOrgReview.php#L295", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L55", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1119", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3746251%40notificationx%2Ftags%2F3.3.4&old=3720837%40notificationx%2Ftags%2F3.3.3", "https://nvd.nist.gov/vuln/detail/CVE-2026-109513" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109513", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cac6c4f3-ac60-45d6-a5ba-6708fc1491a4?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/blocks/Blocks.php#L218", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Features/ShortcodeInline.php#L148", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/WordPress/WPOrgReview.php#L295", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L55", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1119", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3746251%40notificationx%2Ftags%2F3.3.4&old=3720837%40notificationx%2Ftags%2F3.3.3", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109513", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "sourceField": "/containers/cna/title", "excerpt": "NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109513.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpdevteam\",\"product\":\"NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109513（NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 3.3.3 以下のすべての NotificationX プラグインは影響を受けます。\n・管理者が WordPress.org の Reviews キャンペーンを有効化し、public ページに notificationx‑pro/notificationx 動的ブロックを配置している場合に限り、攻撃が可能です。\n・認証されていない攻撃者でもこの脆弱性を利用できます。\n・公式の対象表：wpdevteam / NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar。影響ありとして記載：3.3.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109513", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:42.148Z", "lastSuccess": "2026-10-23T03:20:42.148Z", "sourceCheckedAt": "2026-10-23T02:43:43.464Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109447", "aliases": [], "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor：権限の奪取", "summary": "User Profile Builder プラグイン（バージョン 4.0.3 以下）は、`wppb_add_meta_to_user_on_activation()` 関数が `role` パラメータを検証せずに `WP_User::set_role()` に直接渡すため、特権昇格が可能です。4.0.3 の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、攻撃者は公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信し、メール確認リンクをクリックするだけで、認証されていない状態で管理者権限のアカウントを取得できます。この攻撃が成立するには、サイトに `meta-name` が `role` のレガシーフィールドが残っていること、メール確認が有効であること、そしてユーザー登録がオープンであることが必要です。", "risk": "認証されていない攻撃者が、管理者権限を持つ WordPress アカウントを取得できる可能性があります。", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "range": "<= 4.0.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109447", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109447", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:24.704Z", "modifiedAt": "2026-10-16T15:17:07.557Z", "fetchedAt": "2026-10-23T02:43:43.433Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "sourceTitle": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.0.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109447", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "fetchedAt": "2026-10-23T02:43:43.433Z", "publishedAt": "2026-10-16T05:30:24.704Z", "modifiedAt": "2026-10-16T15:09:38.993Z", "state": "published", "provider": "Wordfence", "title": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]", "descriptions": [ { "lang": "en", "value": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.0.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:38.993Z", "fetchedAt": "2026-10-23T02:43:43.433Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.557Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editorに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:42.198Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "90fed58d2d4714e294cb3742cb90b962d487dc01602b01f754f886e89ae42504", "sourceModifiedAt": "2026-10-16T15:17:07.557Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "User Profile Builder プラグイン（バージョン 4.0.3 以下）は、`wppb_add_meta_to_user_on_activation()` 関数が `role` パラメータを検証せずに `WP_User::set_role()` に直接渡すため、特権昇格が可能です。4.0.3 の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、攻撃者は公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信し、メール確認リンクをクリックするだけで、認証されていない状態で管理者権限のアカウントを取得できます。この攻撃が成立するには、サイトに `meta-name` が `role` のレガシーフィールドが残っていること、メール確認が有効であること、そしてユーザー登録がオープンであることが必要です。", "risk": "認証されていない攻撃者が、管理者権限を持つ WordPress アカウントを取得できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor のバージョン 4.0.3 以下である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "`wppb_add_meta_to_user_on_activation()` 関数が、攻撃者が送信した `role` の値を許可リストなしで `WP_User::set_role()` に渡す。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "4.0.3 以降の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、レガシーフィールドが残る。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "サイトに `meta-name` が `role` のレガシーフィールドが存在すると、攻撃者はそのフィールドを通じて `role` パラメータを制御できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "メール確認が有効で、ユーザー登録がオープンであることが必要。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109447", "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-109447" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109447", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109447", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourceField": "/containers/cna/title", "excerpt": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109447（User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor のバージョン 4.0.3 以下である。\n・`wppb_add_meta_to_user_on_activation()` 関数が、攻撃者が送信した `role` の値を許可リストなしで `WP_User::set_role()` に渡す。\n・4.0.3 以降の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、レガシーフィールドが残る。\n・サイトに `meta-name` が `role` のレガシーフィールドが存在すると、攻撃者はそのフィールドを通じて `role` パラメータを制御できる。\n・公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信できる。\n・メール確認が有効で、ユーザー登録がオープンであることが必要。\n・公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109447", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:42.198Z", "lastSuccess": "2026-10-23T03:20:42.198Z", "sourceCheckedAt": "2026-10-23T02:43:43.433Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-109414", "aliases": [], "title": "Vitepos – Point of Sale (POS) for WooCommerce：データベースへの不正操作", "summary": "Vitepos ≤ 3.6.1 は、ベンダーレベル以上の認証済み攻撃者が 'src_by[].val' パラメータの 'bt' 演算子を通じてブラインドSQLインジェクションを実行できる脆弱性があります。", "risk": "攻撃者はデータベースから機密情報を抽出できる可能性があります。", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "Vitepos – Point of Sale (POS) for WooCommerce", "range": "<= 3.6.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109414", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109414", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:26.454Z", "modifiedAt": "2026-10-16T15:17:07.450Z", "fetchedAt": "2026-10-23T02:43:43.428Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "sourceTitle": "Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "appsbd", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.6.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109414", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "fetchedAt": "2026-10-23T02:43:43.428Z", "publishedAt": "2026-10-16T05:30:26.454Z", "modifiedAt": "2026-10-16T15:09:38.699Z", "state": "published", "provider": "Wordfence", "title": "Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator", "descriptions": [ { "lang": "en", "value": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "appsbd", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.6.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"appsbd\",\"product\":\"Vitepos – Point of Sale (POS) for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.6.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"cweId\":\"CWE-89\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:38.699Z", "fetchedAt": "2026-10-23T02:43:43.428Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.450Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Vitepos – Point of Sale (POS) for WooCommerceにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:42.247Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "dde766669a442662171f75e5b88d96e967cfe1ee0f1972966c0029941dc28efa", "sourceModifiedAt": "2026-10-16T15:17:07.450Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Vitepos ≤ 3.6.1 は、ベンダーレベル以上の認証済み攻撃者が 'src_by[].val' パラメータの 'bt' 演算子を通じてブラインドSQLインジェクションを実行できる脆弱性があります。", "risk": "攻撃者はデータベースから機密情報を抽出できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象は WordPress 用プラグイン Vitepos – Point of Sale (POS) for WooCommerce の全バージョンで、バージョン 3.6.1 以下です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3", "E2", "E1" ] }, { "text": "攻撃者はベンダーレベル以上の認証済みユーザーである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "脆弱性は 'src_by[].val.start' / 'src_by[].val.end' パラメータに対し、'bt'（BETWEEN）演算子を使用した際に、ユーザー入力のエスケープが不十分で、既存のSQLクエリが適切に準備されていないことが原因です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：appsbd / Vitepos – Point of Sale (POS) for WooCommerce。影響ありとして記載：3.6.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Vitepos – Point of Sale (POS) for WooCommerce」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109414", "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "https://nvd.nist.gov/vuln/detail/CVE-2026-109414" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109414", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109414", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourceField": "/containers/cna/title", "excerpt": "Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"appsbd\",\"product\":\"Vitepos – Point of Sale (POS) for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.6.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109414（Vitepos – Point of Sale (POS) for WooCommerce）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は WordPress 用プラグイン Vitepos – Point of Sale (POS) for WooCommerce の全バージョンで、バージョン 3.6.1 以下です。\n・攻撃者はベンダーレベル以上の認証済みユーザーである必要があります。\n・脆弱性は 'src_by[].val.start' / 'src_by[].val.end' パラメータに対し、'bt'（BETWEEN）演算子を使用した際に、ユーザー入力のエスケープが不十分で、既存のSQLクエリが適切に準備されていないことが原因です。\n・公式の対象表：appsbd / Vitepos – Point of Sale (POS) for WooCommerce。影響ありとして記載：3.6.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109414", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:42.247Z", "lastSuccess": "2026-10-23T03:20:42.247Z", "sourceCheckedAt": "2026-10-23T02:43:43.428Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109232", "aliases": [], "title": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas：ブラウザー上での不正な処理", "summary": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas プラグインは、'sln[]' パラメータを通じた保存型クロスサイトスクリプティング（XSS）の脆弱性があります。バージョン10.31.9までのすべてのバージョンで、入力のサニタイズと出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトをページに注入でき、ユーザーがそのページを閲覧すると実行されます。利用には、サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。", "risk": "ユーザーが注入されたページを閲覧した際に、任意のウェブスクリプトが実行される可能性があります。", "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "range": "<= 10.31.9" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109232", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109232", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:24.038Z", "modifiedAt": "2026-10-16T15:17:07.030Z", "fetchedAt": "2026-10-23T02:43:43.231Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "sourceTitle": "Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wordpresschef", "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "10.31.9", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109232", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "fetchedAt": "2026-10-23T02:43:43.231Z", "publishedAt": "2026-10-16T05:30:24.038Z", "modifiedAt": "2026-10-16T14:39:04.204Z", "state": "published", "provider": "Wordfence", "title": "Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX", "descriptions": [ { "lang": "en", "value": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wordpresschef", "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "10.31.9", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wordpresschef\",\"product\":\"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"10.31.9\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.204Z", "fetchedAt": "2026-10-23T02:43:43.231Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.030Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spasにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:43.013Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e40fc306438b978fa441e8d7a2c03f4e4f2c3115e17d7298d5c132d3f1f9e1db", "sourceModifiedAt": "2026-10-16T15:17:07.030Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas プラグインは、'sln[]' パラメータを通じた保存型クロスサイトスクリプティング（XSS）の脆弱性があります。バージョン10.31.9までのすべてのバージョンで、入力のサニタイズと出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトをページに注入でき、ユーザーがそのページを閲覧すると実行されます。利用には、サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。", "risk": "ユーザーが注入されたページを閲覧した際に、任意のウェブスクリプトが実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは WordPress 用の \"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\" です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 10.31.9 まで（含む）のすべてのバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者は認証されていなくても利用可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性は公開予約用 AJAX リクエストで送信される 'sln[]' パラメータを通じて発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wordpresschef / Salon Booking System – Appointment Booking for Salons, Barbershops & Spas。影響ありとして記載：10.31.9以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Salon Booking System – Appointment Booking for Salons, Barbershops & Spas」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109232", "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "https://nvd.nist.gov/vuln/detail/CVE-2026-109232" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109232", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109232", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourceField": "/containers/cna/title", "excerpt": "Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wordpresschef\",\"product\":\"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"10.31.9\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109232（Salon Booking System – Appointment Booking for Salons, Barbershops & Spas）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは WordPress 用の \"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\" です。\n・バージョン 10.31.9 まで（含む）のすべてのバージョンが影響を受けます。\n・攻撃者は認証されていなくても利用可能です。\n・サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。\n・脆弱性は公開予約用 AJAX リクエストで送信される 'sln[]' パラメータを通じて発生します。\n・公式の対象表：wordpresschef / Salon Booking System – Appointment Booking for Salons, Barbershops & Spas。影響ありとして記載：10.31.9以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109232", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:43.013Z", "lastSuccess": "2026-10-23T03:20:43.013Z", "sourceCheckedAt": "2026-10-23T02:43:43.231Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } } ], "total": 2162, "limit": 20, "offset": 240, "filters": { "product": "all", "type": "all", "q": "", "page": 13 }, "pagination": { "page": 13, "pageSize": 20, "totalPages": 109 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T04:17:50.783Z", "lastAttempt": "2026-10-23T04:17:50.783Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-23T04:17:50.783Z", "lastAttempt": "2026-10-23T04:17:50.783Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T04:17:50.783Z", "lastAttempt": "2026-10-23T04:17:50.783Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T04:17:50.783Z", "lastAttempt": "2026-10-23T04:17:50.783Z", "error": null, "recordCount": 3, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T03:02:49.705Z 〜 2026-10-23T04:17:50.783Z、全製品の変更 14/14件まで確認、対象3件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T04:17:50.783Z", "lastAttempt": "2026-10-23T04:17:50.783Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }