{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-109447", "aliases": [], "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor：権限の奪取", "summary": "User Profile Builder プラグイン（バージョン 4.0.3 以下）は、`wppb_add_meta_to_user_on_activation()` 関数が `role` パラメータを検証せずに `WP_User::set_role()` に直接渡すため、特権昇格が可能です。4.0.3 の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、攻撃者は公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信し、メール確認リンクをクリックするだけで、認証されていない状態で管理者権限のアカウントを取得できます。この攻撃が成立するには、サイトに `meta-name` が `role` のレガシーフィールドが残っていること、メール確認が有効であること、そしてユーザー登録がオープンであることが必要です。", "risk": "認証されていない攻撃者が、管理者権限を持つ WordPress アカウントを取得できる可能性があります。", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "range": "<= 4.0.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109447", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109447", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:24.704Z", "modifiedAt": "2026-10-16T15:17:07.557Z", "fetchedAt": "2026-10-23T02:43:43.433Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "sourceTitle": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.0.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109447", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "fetchedAt": "2026-10-23T02:43:43.433Z", "publishedAt": "2026-10-16T05:30:24.704Z", "modifiedAt": "2026-10-16T15:09:38.993Z", "state": "published", "provider": "Wordfence", "title": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]", "descriptions": [ { "lang": "en", "value": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.0.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:38.993Z", "fetchedAt": "2026-10-23T02:43:43.433Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.557Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editorに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:42.198Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "90fed58d2d4714e294cb3742cb90b962d487dc01602b01f754f886e89ae42504", "sourceModifiedAt": "2026-10-16T15:17:07.557Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "User Profile Builder プラグイン（バージョン 4.0.3 以下）は、`wppb_add_meta_to_user_on_activation()` 関数が `role` パラメータを検証せずに `WP_User::set_role()` に直接渡すため、特権昇格が可能です。4.0.3 の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、攻撃者は公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信し、メール確認リンクをクリックするだけで、認証されていない状態で管理者権限のアカウントを取得できます。この攻撃が成立するには、サイトに `meta-name` が `role` のレガシーフィールドが残っていること、メール確認が有効であること、そしてユーザー登録がオープンであることが必要です。", "risk": "認証されていない攻撃者が、管理者権限を持つ WordPress アカウントを取得できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor のバージョン 4.0.3 以下である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "`wppb_add_meta_to_user_on_activation()` 関数が、攻撃者が送信した `role` の値を許可リストなしで `WP_User::set_role()` に渡す。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "4.0.3 以降の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、レガシーフィールドが残る。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "サイトに `meta-name` が `role` のレガシーフィールドが存在すると、攻撃者はそのフィールドを通じて `role` パラメータを制御できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "メール確認が有効で、ユーザー登録がオープンであることが必要。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109447", "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-109447" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109447", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L262", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L793", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/class-formbuilder.php#L736", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/register.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/admin/admin-functions.php#L400", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/email-confirmation.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109447", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-existing form fields from the block, allowing a legacy field with meta-name `role` to persist and bridge attacker-controlled request input into the serialized signup record stored in `wp_signups`. This makes it possible for unauthenticated attackers to gain a fully activated WordPress administrator account by submitting `role=administrator` through the public `[wppb-register]` shortcode form and subsequently clicking the confirmation activation link. Exploitation requires the site to have a legacy form field with meta-name `role` carried over from before the 4.0.3 upgrade, email confirmation enabled, and open user registration — all stable site-state conditions once established.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourceField": "/containers/cna/title", "excerpt": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109447.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109447（User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor のバージョン 4.0.3 以下である。\n・`wppb_add_meta_to_user_on_activation()` 関数が、攻撃者が送信した `role` の値を許可リストなしで `WP_User::set_role()` に渡す。\n・4.0.3 以降の予約名チェックは、アップグレード前に作成された `meta-name` が `role` のフィールドを除外しないため、レガシーフィールドが残る。\n・サイトに `meta-name` が `role` のレガシーフィールドが存在すると、攻撃者はそのフィールドを通じて `role` パラメータを制御できる。\n・公開ショートコード `[wppb-register]` のフォームに `role=administrator` を送信できる。\n・メール確認が有効で、ユーザー登録がオープンであることが必要。\n・公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109447", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:42.198Z", "lastSuccess": "2026-10-23T03:20:42.198Z", "sourceCheckedAt": "2026-10-23T02:43:43.433Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-109414", "aliases": [], "title": "Vitepos – Point of Sale (POS) for WooCommerce：データベースへの不正操作", "summary": "Vitepos ≤ 3.6.1 は、ベンダーレベル以上の認証済み攻撃者が 'src_by[].val' パラメータの 'bt' 演算子を通じてブラインドSQLインジェクションを実行できる脆弱性があります。", "risk": "攻撃者はデータベースから機密情報を抽出できる可能性があります。", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "Vitepos – Point of Sale (POS) for WooCommerce", "range": "<= 3.6.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109414", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109414", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:26.454Z", "modifiedAt": "2026-10-16T15:17:07.450Z", "fetchedAt": "2026-10-23T02:43:43.428Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "sourceTitle": "Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "appsbd", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.6.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109414", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "fetchedAt": "2026-10-23T02:43:43.428Z", "publishedAt": "2026-10-16T05:30:26.454Z", "modifiedAt": "2026-10-16T15:09:38.699Z", "state": "published", "provider": "Wordfence", "title": "Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator", "descriptions": [ { "lang": "en", "value": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "appsbd", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.6.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"appsbd\",\"product\":\"Vitepos – Point of Sale (POS) for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.6.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"cweId\":\"CWE-89\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:38.699Z", "fetchedAt": "2026-10-23T02:43:43.428Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.450Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Vitepos – Point of Sale (POS) for WooCommerceにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:42.247Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "dde766669a442662171f75e5b88d96e967cfe1ee0f1972966c0029941dc28efa", "sourceModifiedAt": "2026-10-16T15:17:07.450Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Vitepos ≤ 3.6.1 は、ベンダーレベル以上の認証済み攻撃者が 'src_by[].val' パラメータの 'bt' 演算子を通じてブラインドSQLインジェクションを実行できる脆弱性があります。", "risk": "攻撃者はデータベースから機密情報を抽出できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象は WordPress 用プラグイン Vitepos – Point of Sale (POS) for WooCommerce の全バージョンで、バージョン 3.6.1 以下です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3", "E2", "E1" ] }, { "text": "攻撃者はベンダーレベル以上の認証済みユーザーである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "脆弱性は 'src_by[].val.start' / 'src_by[].val.end' パラメータに対し、'bt'（BETWEEN）演算子を使用した際に、ユーザー入力のエスケープが不十分で、既存のSQLクエリが適切に準備されていないことが原因です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：appsbd / Vitepos – Point of Sale (POS) for WooCommerce。影響ありとして記載：3.6.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Vitepos – Point of Sale (POS) for WooCommerce」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109414", "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "https://nvd.nist.gov/vuln/detail/CVE-2026-109414" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109414", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vendor/appsbd-wp/appsbd-lite/appsbd_lite/v6/core/class-basemodel.php#L2925", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/libs/class-api-base.php#L467", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-vendor-api.php#L74", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-outlet-api.php#L66", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/vitepos-lite/tags/3.6.1/vitepos_lite/api/v1/class-pos-purchase-api.php#L71", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3732582%40vitepos-lite&new=3732582%40vitepos-lite", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109414", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourceField": "/containers/cna/title", "excerpt": "Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109414.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"appsbd\",\"product\":\"Vitepos – Point of Sale (POS) for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.6.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109414（Vitepos – Point of Sale (POS) for WooCommerce）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は WordPress 用プラグイン Vitepos – Point of Sale (POS) for WooCommerce の全バージョンで、バージョン 3.6.1 以下です。\n・攻撃者はベンダーレベル以上の認証済みユーザーである必要があります。\n・脆弱性は 'src_by[].val.start' / 'src_by[].val.end' パラメータに対し、'bt'（BETWEEN）演算子を使用した際に、ユーザー入力のエスケープが不十分で、既存のSQLクエリが適切に準備されていないことが原因です。\n・公式の対象表：appsbd / Vitepos – Point of Sale (POS) for WooCommerce。影響ありとして記載：3.6.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109414", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:42.247Z", "lastSuccess": "2026-10-23T03:20:42.247Z", "sourceCheckedAt": "2026-10-23T02:43:43.428Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109232", "aliases": [], "title": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas：ブラウザー上での不正な処理", "summary": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas プラグインは、'sln[]' パラメータを通じた保存型クロスサイトスクリプティング（XSS）の脆弱性があります。バージョン10.31.9までのすべてのバージョンで、入力のサニタイズと出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトをページに注入でき、ユーザーがそのページを閲覧すると実行されます。利用には、サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。", "risk": "ユーザーが注入されたページを閲覧した際に、任意のウェブスクリプトが実行される可能性があります。", "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "range": "<= 10.31.9" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109232", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109232", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:24.038Z", "modifiedAt": "2026-10-16T15:17:07.030Z", "fetchedAt": "2026-10-23T02:43:43.231Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "sourceTitle": "Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wordpresschef", "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "10.31.9", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109232", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "fetchedAt": "2026-10-23T02:43:43.231Z", "publishedAt": "2026-10-16T05:30:24.038Z", "modifiedAt": "2026-10-16T14:39:04.204Z", "state": "published", "provider": "Wordfence", "title": "Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX", "descriptions": [ { "lang": "en", "value": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wordpresschef", "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "10.31.9", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wordpresschef\",\"product\":\"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"10.31.9\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.204Z", "fetchedAt": "2026-10-23T02:43:43.231Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.030Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spasにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:43.013Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e40fc306438b978fa441e8d7a2c03f4e4f2c3115e17d7298d5c132d3f1f9e1db", "sourceModifiedAt": "2026-10-16T15:17:07.030Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas プラグインは、'sln[]' パラメータを通じた保存型クロスサイトスクリプティング（XSS）の脆弱性があります。バージョン10.31.9までのすべてのバージョンで、入力のサニタイズと出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトをページに注入でき、ユーザーがそのページを閲覧すると実行されます。利用には、サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。", "risk": "ユーザーが注入されたページを閲覧した際に、任意のウェブスクリプトが実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは WordPress 用の \"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\" です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 10.31.9 まで（含む）のすべてのバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者は認証されていなくても利用可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性は公開予約用 AJAX リクエストで送信される 'sln[]' パラメータを通じて発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wordpresschef / Salon Booking System – Appointment Booking for Salons, Barbershops & Spas。影響ありとして記載：10.31.9以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Salon Booking System – Appointment Booking for Salons, Barbershops & Spas」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109232", "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "https://nvd.nist.gov/vuln/detail/CVE-2026-109232" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109232", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/DetailsStep.php#L179", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Shortcode/Salon/AbstractUserStep.php#L46", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Form.php#L321", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L110", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/src/SLN/Action/Init.php#L645", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.31.9/views/admin/_customer.php#L116", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3742306%40salon-booking-system&new=3742306%40salon-booking-system", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109232", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourceField": "/containers/cna/title", "excerpt": "Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109232.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wordpresschef\",\"product\":\"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"10.31.9\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109232（Salon Booking System – Appointment Booking for Salons, Barbershops & Spas）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは WordPress 用の \"Salon Booking System – Appointment Booking for Salons, Barbershops & Spas\" です。\n・バージョン 10.31.9 まで（含む）のすべてのバージョンが影響を受けます。\n・攻撃者は認証されていなくても利用可能です。\n・サイト管理者が Html または File タイプのカスタムチェックアウトフィールドを少なくとも1つ設定している必要があります。\n・脆弱性は公開予約用 AJAX リクエストで送信される 'sln[]' パラメータを通じて発生します。\n・公式の対象表：wordpresschef / Salon Booking System – Appointment Booking for Salons, Barbershops & Spas。影響ありとして記載：10.31.9以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109232", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:43.013Z", "lastSuccess": "2026-10-23T03:20:43.013Z", "sourceCheckedAt": "2026-10-23T02:43:43.231Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-107764", "aliases": [], "title": "SiteOrigin CSS：ブラウザー上での不正な処理", "summary": "SiteOrigin CSSプラグインは、バージョン1.6.7までで、コメント作者URLパラメータ（'url (comment_author_url)'）の入力サニタイズと出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトを保存型DOMベースXSSとして注入できる。WordPressコアの esc_url() がHTMLエンティティエンコードされた文字を保持するため、コメントの「Website」フィールドにエンコードされたペイロードが保存され、ブラウザでDOMデコードされ実行される。", "risk": "ユーザーがそのページを閲覧すると、任意のウェブスクリプトが実行される可能性がある。", "product": "SiteOrigin CSS", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "SiteOrigin CSS", "range": "<= 1.6.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107764", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ff9652-1b45-43d6-949a-92bfeaee96d3?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/js/inspector.js#L280", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L69", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L899", "label": "security@wordfence.com" }, { "url": "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107764", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:26.095Z", "modifiedAt": "2026-10-16T15:17:05.660Z", "fetchedAt": "2026-10-23T02:43:42.838Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.", "sourceTitle": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "gpriday", "product": "SiteOrigin CSS", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.6.7", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-107764", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "fetchedAt": "2026-10-23T02:43:42.838Z", "publishedAt": "2026-10-16T05:30:26.095Z", "modifiedAt": "2026-10-16T14:30:23.414Z", "state": "published", "provider": "Wordfence", "title": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink", "descriptions": [ { "lang": "en", "value": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "gpriday", "product": "SiteOrigin CSS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.6.7", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ff9652-1b45-43d6-949a-92bfeaee96d3?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/js/inspector.js#L280", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L69", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L899", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"gpriday\",\"product\":\"SiteOrigin CSS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.6.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:30:23.414Z", "fetchedAt": "2026-10-23T02:43:42.838Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:05.660Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "SiteOrigin CSSにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:43.521Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3e18ea303d63ba0626885d619d4e0b98d651ff609ff420a686944a1a9ad0148c", "sourceModifiedAt": "2026-10-16T15:17:05.660Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SiteOrigin CSSプラグインは、バージョン1.6.7までで、コメント作者URLパラメータ（'url (comment_author_url)'）の入力サニタイズと出力エスケープが不十分なため、認証されていない攻撃者が任意のウェブスクリプトを保存型DOMベースXSSとして注入できる。WordPressコアの esc_url() がHTMLエンティティエンコードされた文字を保持するため、コメントの「Website」フィールドにエンコードされたペイロードが保存され、ブラウザでDOMデコードされ実行される。", "risk": "ユーザーがそのページを閲覧すると、任意のウェブスクリプトが実行される可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "SiteOrigin CSSプラグインのバージョン1.6.7以下すべてが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証されていない攻撃者がコメントの「Website」フィールドにエンティティエンコードされたペイロードを入力できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "WordPressコアの esc_url() がHTMLエンティティエンコードされた文字を保持するため、入力のサニタイズと出力エスケープが不十分になる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "保存されたペイロードはブラウザでDOMデコードされ、ページが表示されるたびに任意のウェブスクリプトが実行される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：gpriday / SiteOrigin CSS。影響ありとして記載：1.6.7以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「SiteOrigin CSS」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-107764", "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ff9652-1b45-43d6-949a-92bfeaee96d3?source=cve", "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/js/inspector.js#L280", "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L69", "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L899", "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "https://nvd.nist.gov/vuln/detail/CVE-2026-107764" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107764", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ff9652-1b45-43d6-949a-92bfeaee96d3?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/js/inspector.js#L280", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L69", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/so-css/tags/1.6.6/so-css.php#L899", "label": "security@wordfence.com" }, { "url": "https://github.com/siteorigin/so-css/compare/1.6.7...1.6.8", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107764", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "sourceField": "/containers/cna/title", "excerpt": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107764.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"gpriday\",\"product\":\"SiteOrigin CSS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.6.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-107764（SiteOrigin CSS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・SiteOrigin CSSプラグインのバージョン1.6.7以下すべてが影響を受ける。\n・認証されていない攻撃者がコメントの「Website」フィールドにエンティティエンコードされたペイロードを入力できる。\n・WordPressコアの esc_url() がHTMLエンティティエンコードされた文字を保持するため、入力のサニタイズと出力エスケープが不十分になる。\n・保存されたペイロードはブラウザでDOMデコードされ、ページが表示されるたびに任意のウェブスクリプトが実行される。\n・公式の対象表：gpriday / SiteOrigin CSS。影響ありとして記載：1.6.7以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-107764", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:43.521Z", "lastSuccess": "2026-10-23T03:20:43.521Z", "sourceCheckedAt": "2026-10-23T02:43:42.838Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-107748", "aliases": [], "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor：ブラウザー上での不正な処理", "summary": "User Profile Builder プラグインは、'display_name' パラメータの入力を十分にサニタイズ・エスケープしないため、保存型クロスサイトスクリプティングの脆弱性があります。認証済みの攻撃者（購読者レベル以上）が任意のウェブスクリプトをコメントの author フィールドに埋め込むことができ、ページが表示されるたびにそのスクリプトが実行されます。スクリプトは wp_comments.comment_author に永続的に保存され、攻撃者の表示名を変更・削除してもスクリプトは無効化されません。", "risk": "ページが表示されるたびに、埋め込まれたスクリプトが実行されるため、閲覧者のブラウザーで不正な処理が行われる可能性があります。", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "range": "<= 4.0.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107748", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f466add-992b-46c7-a1cc-5c05d59f4bdf?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L582", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L585", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L593", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/display-name/display-name.php#L81", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/functions.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107748", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:20.376Z", "modifiedAt": "2026-10-16T15:17:05.440Z", "fetchedAt": "2026-10-23T02:43:42.665Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists in wp_comments.comment_author independently of the user account, so removing or changing the attacker's display name after the comment is posted does not neutralize the stored script.", "sourceTitle": "User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.0.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-107748", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "fetchedAt": "2026-10-23T02:43:42.665Z", "publishedAt": "2026-10-16T05:30:20.376Z", "modifiedAt": "2026-10-16T14:39:04.655Z", "state": "published", "provider": "Wordfence", "title": "User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter", "descriptions": [ { "lang": "en", "value": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists in wp_comments.comment_author independently of the user account, so removing or changing the attacker's display name after the comment is posted does not neutralize the stored script.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.0.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f466add-992b-46c7-a1cc-5c05d59f4bdf?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L582", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L585", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L593", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/display-name/display-name.php#L81", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/functions.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists in wp_comments.comment_author independently of the user account, so removing or changing the attacker's display name after the comment is posted does not neutralize the stored script.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.655Z", "fetchedAt": "2026-10-23T02:43:42.665Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:05.440Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editorにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:44.432Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e7e1a556fc34fee0a9d13a505ab36634593bec1b5c4ea2c5b5cf5d3e5a7b1d0f", "sourceModifiedAt": "2026-10-16T15:17:05.440Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "User Profile Builder プラグインは、'display_name' パラメータの入力を十分にサニタイズ・エスケープしないため、保存型クロスサイトスクリプティングの脆弱性があります。認証済みの攻撃者（購読者レベル以上）が任意のウェブスクリプトをコメントの author フィールドに埋め込むことができ、ページが表示されるたびにそのスクリプトが実行されます。スクリプトは wp_comments.comment_author に永続的に保存され、攻撃者の表示名を変更・削除してもスクリプトは無効化されません。", "risk": "ページが表示されるたびに、埋め込まれたスクリプトが実行されるため、閲覧者のブラウザーで不正な処理が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "プラグイン「User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor」のバージョンが 4.0.3 以下である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E3", "E1", "E2" ] }, { "text": "攻撃者が WordPress に subscriber 以上の権限で認証済みである。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者が 'display_name' パラメータを利用してコメントを投稿できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ペイロードが wp_comments.comment_author に保存され、攻撃者の表示名を変更・削除してもスクリプトは無効化されない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-107748", "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f466add-992b-46c7-a1cc-5c05d59f4bdf?source=cve", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L582", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L585", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L593", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/display-name/display-name.php#L81", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/functions.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-107748" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107748", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f466add-992b-46c7-a1cc-5c05d59f4bdf?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L582", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L585", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/functions.php#L593", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/display-name/display-name.php#L81", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/functions.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107748", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists in wp_comments.comment_author independently of the user account, so removing or changing the attacker's display name after the comment is posted does not neutralize the stored script.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "sourceField": "/containers/cna/title", "excerpt": "User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107748.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-107748（User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・プラグイン「User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor」のバージョンが 4.0.3 以下である。\n・攻撃者が WordPress に subscriber 以上の権限で認証済みである。\n・攻撃者が 'display_name' パラメータを利用してコメントを投稿できる。\n・ペイロードが wp_comments.comment_author に保存され、攻撃者の表示名を変更・削除してもスクリプトは無効化されない。\n・公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-107748", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:44.432Z", "lastSuccess": "2026-10-23T03:20:44.432Z", "sourceCheckedAt": "2026-10-23T02:43:42.665Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-104932", "aliases": [], "title": "Search Regex：コード実行", "summary": "Search Regex プラグイン（バージョン3.5）において、認証済みのユーザー（購読者以上）が、ユーザーメタのシリアライズされた文字列を破壊し、replace_all 関数で信頼できない入力をデシリアライズすることで、リモートコード実行が可能になる脆弱性です。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "product": "Search Regex", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "affected": [ { "product": "Search Regex", "range": "<= 3.5" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104932", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3730910%40search-regex%2Ftags%2F3.5.1&old=3729403%40search-regex%2Ftags%2F3.5", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104932", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:27.126Z", "modifiedAt": "2026-10-16T15:17:03.793Z", "fetchedAt": "2026-10-23T02:43:41.792Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.", "sourceTitle": "Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "johnny5", "product": "Search Regex", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.5", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104932", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "fetchedAt": "2026-10-23T02:43:41.792Z", "publishedAt": "2026-10-16T05:30:27.126Z", "modifiedAt": "2026-10-16T14:53:13.234Z", "state": "published", "provider": "Wordfence", "title": "Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption", "descriptions": [ { "lang": "en", "value": "The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "johnny5", "product": "Search Regex", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3730910%40search-regex%2Ftags%2F3.5.1&old=3729403%40search-regex%2Ftags%2F3.5", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"johnny5\",\"product\":\"Search Regex\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-502 Deserialization of Untrusted Data\",\"cweId\":\"CWE-502\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:53:13.234Z", "fetchedAt": "2026-10-23T02:43:41.792Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:03.793Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Search Regexにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:45.338Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8959cc8580dddef9fc62d0cc0087e12ac2abd6f70500fd10b73507d7af526390", "sourceModifiedAt": "2026-10-16T15:17:03.793Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Search Regex プラグイン（バージョン3.5）において、認証済みのユーザー（購読者以上）が、ユーザーメタのシリアライズされた文字列を破壊し、replace_all 関数で信頼できない入力をデシリアライズすることで、リモートコード実行が可能になる脆弱性です。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Search Regex プラグインのバージョン3.5までが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "認証済みのユーザーで、購読者（Subscriber）以上の権限が必要である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "脆弱性は replace_all 関数で信頼できない入力をデシリアライズすることで発生する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：johnny5 / Search Regex。影響ありとして記載：3.5以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Search Regex」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104932", "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=cve", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3730910%40search-regex%2Ftags%2F3.5.1&old=3729403%40search-regex%2Ftags%2F3.5", "https://nvd.nist.gov/vuln/detail/CVE-2026-104932" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104932", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3730910%40search-regex%2Ftags%2F3.5.1&old=3729403%40search-regex%2Ftags%2F3.5", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104932", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "sourceField": "/containers/cna/title", "excerpt": "Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104932.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"johnny5\",\"product\":\"Search Regex\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104932（Search Regex）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Search Regex プラグインのバージョン3.5までが影響を受ける。\n・認証済みのユーザーで、購読者（Subscriber）以上の権限が必要である。\n・脆弱性は replace_all 関数で信頼できない入力をデシリアライズすることで発生する。\n・公式の対象表：johnny5 / Search Regex。影響ありとして記載：3.5以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104932", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:45.338Z", "lastSuccess": "2026-10-23T03:20:45.338Z", "sourceCheckedAt": "2026-10-23T02:43:41.792Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-104001", "aliases": [], "title": "Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated：脆弱性情報", "summary": "Slim SEO – AI SEO Plugin のバージョン 4.11.1 以下すべてにおいて、Subscriber 以上の権限を持つ認証済みユーザーが自分の「Biographical Info」欄にショートコードを保存すると、そのショートコードが未認証のフロントエンドリクエスト（例: auto_redirection が無効な状態で ?author= クエリを使用したリクエスト）で実行されます。", "risk": "任意のショートコードが実行されるため、攻撃者が不正な処理をページ上で走らせることが可能になります。", "product": "Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated", "range": "<= 4.11.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104001", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7c53b9-e9b6-4337-9c89-326e66c4bd27?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L26", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Data.php#L76", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L168", "label": "security@wordfence.com" }, { "url": "https://github.com/elightup/slim-seo/pull/296", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3742833%40slim-seo%2Ftags%2F4.11.2&old=3717070%40slim-seo%2Ftags%2F4.11.0", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104001", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:23.705Z", "modifiedAt": "2026-10-16T15:17:02.993Z", "fetchedAt": "2026-10-23T02:43:41.462Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.", "sourceTitle": "Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "rilwis", "product": "Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.11.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104001", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "fetchedAt": "2026-10-23T02:43:41.462Z", "publishedAt": "2026-10-16T05:30:23.705Z", "modifiedAt": "2026-10-16T15:09:39.289Z", "state": "published", "provider": "Wordfence", "title": "Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta", "descriptions": [ { "lang": "en", "value": "The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "rilwis", "product": "Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.11.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7c53b9-e9b6-4337-9c89-326e66c4bd27?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L26", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Data.php#L76", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L168", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://github.com/elightup/slim-seo/pull/296", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3742833%40slim-seo%2Ftags%2F4.11.2&old=3717070%40slim-seo%2Ftags%2F4.11.0", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"rilwis\",\"product\":\"Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.11.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-94 Improper Control of Generation of Code ('Code Injection')\",\"cweId\":\"CWE-94\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:39.289Z", "fetchedAt": "2026-10-23T02:43:41.462Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.993Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Slim SEO – AI SEO Plugin, Lightweight, Fast & Automatedに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:46.907Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fa6385b8b60e2264d2ebcc11d600d042e2907d74091c4c0f7aaaaff31121841d", "sourceModifiedAt": "2026-10-16T15:17:02.993Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Slim SEO – AI SEO Plugin のバージョン 4.11.1 以下すべてにおいて、Subscriber 以上の権限を持つ認証済みユーザーが自分の「Biographical Info」欄にショートコードを保存すると、そのショートコードが未認証のフロントエンドリクエスト（例: auto_redirection が無効な状態で ?author= クエリを使用したリクエスト）で実行されます。", "risk": "任意のショートコードが実行されるため、攻撃者が不正な処理をページ上で走らせることが可能になります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Slim SEO プラグインのバージョン 4.11.1 以下すべてが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "影響を受けるには、Subscriber 以上の権限を持つ認証済みユーザーである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は自分のプロフィールの「Biographical Info」欄にショートコードを保存できること（REST API または wp‑admin のプロフィールページから）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "保存されたショートコードは、著者の説明が表示される未認証のフロントエンドリクエストで実行されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "例として、auto_redirection が無効化されている状態で ?author= クエリパラメータを付けたリクエストが該当します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：rilwis / Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated。影響ありとして記載：4.11.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104001", "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7c53b9-e9b6-4337-9c89-326e66c4bd27?source=cve", "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L26", "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Data.php#L76", "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L168", "https://github.com/elightup/slim-seo/pull/296", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3742833%40slim-seo%2Ftags%2F4.11.2&old=3717070%40slim-seo%2Ftags%2F4.11.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-104001" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104001", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7c53b9-e9b6-4337-9c89-326e66c4bd27?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L26", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Data.php#L76", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.11.0/src/MetaTags/Helper.php#L168", "label": "security@wordfence.com" }, { "url": "https://github.com/elightup/slim-seo/pull/296", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3742833%40slim-seo%2Ftags%2F4.11.2&old=3717070%40slim-seo%2Ftags%2F4.11.0", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104001", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "sourceField": "/containers/cna/title", "excerpt": "Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104001.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"rilwis\",\"product\":\"Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.11.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104001（Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Slim SEO プラグインのバージョン 4.11.1 以下すべてが影響を受けます。\n・影響を受けるには、Subscriber 以上の権限を持つ認証済みユーザーである必要があります。\n・攻撃者は自分のプロフィールの「Biographical Info」欄にショートコードを保存できること（REST API または wp‑admin のプロフィールページから）。\n・保存されたショートコードは、著者の説明が表示される未認証のフロントエンドリクエストで実行されます。\n・例として、auto_redirection が無効化されている状態で ?author= クエリパラメータを付けたリクエストが該当します。\n・公式の対象表：rilwis / Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated。影響ありとして記載：4.11.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104001", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:46.907Z", "lastSuccess": "2026-10-23T03:20:46.907Z", "sourceCheckedAt": "2026-10-23T02:43:41.462Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-104000", "aliases": [], "title": "Simply Schedule Appointments：ブラウザー上での不正な処理", "summary": "Simply Schedule Appointments プラグイン（WordPress 用）は、バージョン 1.6.12.35 までのすべてのバージョンで、'status' パラメータの入力サニタイズと出力エスケープが不十分なため、未認証の攻撃者が任意のウェブスクリプトを保存型クロスサイトスクリプティング（Stored XSS）として注入できる。デバッグログがデフォルトで有効になっており、デバッグログビューアがサイト全体の Support PIN（AUTH_SALT の HMAC‑MD5）を保持している者に閲覧可能なため、注入されたスクリプトは管理者のセッションで実行される可能性がある。", "risk": "攻撃者が注入したスクリプトがページを閲覧したユーザーのブラウザーで実行され、特に管理者のセッションがサポートやトラブルシューティング時に乗っ取られる可能性がある。", "product": "Simply Schedule Appointments", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Simply Schedule Appointments", "range": "<= 1.6.12.35" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104000", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a8bd422-112c-43bc-a041-3c6eea27b790?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-debug.php#L92", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-appointment-model.php#L1490", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-utils.php#L716", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746344/simply-schedule-appointments/trunk/includes/class-appointment-model.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104000", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:21.082Z", "modifiedAt": "2026-10-16T16:16:54.417Z", "fetchedAt": "2026-10-23T02:43:41.354Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.", "sourceTitle": "Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "croixhaug", "product": "Simply Schedule Appointments", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.6.12.35", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104000", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "fetchedAt": "2026-10-23T02:43:41.354Z", "publishedAt": "2026-10-16T05:30:21.082Z", "modifiedAt": "2026-10-16T15:45:05.671Z", "state": "published", "provider": "Wordfence", "title": "Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}", "descriptions": [ { "lang": "en", "value": "The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "croixhaug", "product": "Simply Schedule Appointments", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.6.12.35", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a8bd422-112c-43bc-a041-3c6eea27b790?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-debug.php#L92", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-appointment-model.php#L1490", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-utils.php#L716", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746344/simply-schedule-appointments/trunk/includes/class-appointment-model.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"croixhaug\",\"product\":\"Simply Schedule Appointments\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.6.12.35\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:45:05.671Z", "fetchedAt": "2026-10-23T02:43:41.354Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:16:54.417Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Simply Schedule Appointmentsにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:48.672Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0ec55417f55fba6c07013a2e01d77d0189adf95897b1f16ee2262b0b823ee773", "sourceModifiedAt": "2026-10-16T16:16:54.417Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Simply Schedule Appointments プラグイン（WordPress 用）は、バージョン 1.6.12.35 までのすべてのバージョンで、'status' パラメータの入力サニタイズと出力エスケープが不十分なため、未認証の攻撃者が任意のウェブスクリプトを保存型クロスサイトスクリプティング（Stored XSS）として注入できる。デバッグログがデフォルトで有効になっており、デバッグログビューアがサイト全体の Support PIN（AUTH_SALT の HMAC‑MD5）を保持している者に閲覧可能なため、注入されたスクリプトは管理者のセッションで実行される可能性がある。", "risk": "攻撃者が注入したスクリプトがページを閲覧したユーザーのブラウザーで実行され、特に管理者のセッションがサポートやトラブルシューティング時に乗っ取られる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは WordPress 用の Simply Schedule Appointments である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 1.6.12.35 以下（含む）のすべてのバージョンが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "デバッグログが有効であること（デフォルトで有効）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "サイト全体の Support PIN（AUTH_SALT の HMAC‑MD5）が閲覧可能であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：croixhaug / Simply Schedule Appointments。影響ありとして記載：1.6.12.35以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Simply Schedule Appointments」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104000", "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a8bd422-112c-43bc-a041-3c6eea27b790?source=cve", "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-debug.php#L92", "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-appointment-model.php#L1490", "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-utils.php#L716", "https://plugins.trac.wordpress.org/changeset/3746344/simply-schedule-appointments/trunk/includes/class-appointment-model.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-104000" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104000", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a8bd422-112c-43bc-a041-3c6eea27b790?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-debug.php#L92", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-appointment-model.php#L1490", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.33/includes/class-utils.php#L716", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746344/simply-schedule-appointments/trunk/includes/class-appointment-model.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104000", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is stored unconditionally because debug logging is enabled by default, and the debug-log viewer is accessible to anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), meaning the injected script will execute against the administrator's session during ordinary support or troubleshooting workflows.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "sourceField": "/containers/cna/title", "excerpt": "Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104000.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"croixhaug\",\"product\":\"Simply Schedule Appointments\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.6.12.35\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104000（Simply Schedule Appointments）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは WordPress 用の Simply Schedule Appointments である。\n・バージョン 1.6.12.35 以下（含む）のすべてのバージョンが影響を受ける。\n・デバッグログが有効であること（デフォルトで有効）。\n・サイト全体の Support PIN（AUTH_SALT の HMAC‑MD5）が閲覧可能であること。\n・公式の対象表：croixhaug / Simply Schedule Appointments。影響ありとして記載：1.6.12.35以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104000", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:48.672Z", "lastSuccess": "2026-10-23T03:20:48.672Z", "sourceCheckedAt": "2026-10-23T02:43:41.354Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-103999", "aliases": [], "title": "Ultra Addons for Contact Form 7：ブラウザー上での不正な処理", "summary": "Ultra Addons for Contact Form 7 のバージョン 3.5.54 以下において、認証されていない攻撃者がファイルアップロード機能を利用して保存型クロスサイトスクリプティング（XSS）を実行できる脆弱性があります。", "risk": "攻撃者が埋め込んだ任意のウェブスクリプトが、ページを閲覧したユーザーのブラウザーで実行され、情報漏洩や操作が行われる可能性があります。", "product": "Ultra Addons for Contact Form 7", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Ultra Addons for Contact Form 7", "range": "<= 3.5.54" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103999", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/29b9d978-f8b0-48f9-a10e-7e61a4f4a828?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L901", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L895", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L869", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/inc/functions.php#L1703", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/ultimate-addons-for-contact-form-7.zip", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103999", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:20.027Z", "modifiedAt": "2026-10-16T15:17:02.880Z", "fetchedAt": "2026-10-23T02:43:41.332Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '', as the check classifies these files as text/plain without inspecting their byte content.", "sourceTitle": "Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "themefic", "product": "Ultra Addons for Contact Form 7", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.5.54", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103999", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "fetchedAt": "2026-10-23T02:43:41.332Z", "publishedAt": "2026-10-16T05:30:20.027Z", "modifiedAt": "2026-10-16T14:39:04.802Z", "state": "published", "provider": "Wordfence", "title": "Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload", "descriptions": [ { "lang": "en", "value": "The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '', as the check classifies these files as text/plain without inspecting their byte content.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "themefic", "product": "Ultra Addons for Contact Form 7", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.5.54", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/29b9d978-f8b0-48f9-a10e-7e61a4f4a828?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L901", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L895", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L869", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/inc/functions.php#L1703", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://downloads.wordpress.org/plugin/ultimate-addons-for-contact-form-7.zip", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"themefic\",\"product\":\"Ultra Addons for Contact Form 7\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.5.54\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '', as the check classifies these files as text/plain without inspecting their byte content.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:04.802Z", "fetchedAt": "2026-10-23T02:43:41.332Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.880Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Ultra Addons for Contact Form 7にブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:48.730Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "22151fca39e1fb94fe1909c9b12a1f01a7b0100cf7b757ead1177d02502a5f52", "sourceModifiedAt": "2026-10-16T15:17:02.880Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Ultra Addons for Contact Form 7 のバージョン 3.5.54 以下において、認証されていない攻撃者がファイルアップロード機能を利用して保存型クロスサイトスクリプティング（XSS）を実行できる脆弱性があります。", "risk": "攻撃者が埋め込んだ任意のウェブスクリプトが、ページを閲覧したユーザーのブラウザーで実行され、情報漏洩や操作が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "影響を受けるのは、Ultra Addons for Contact Form 7 のバージョン 0（プレースホルダー）から 3.5.54 までのすべてのバージョンです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "認証されていない攻撃者でもこの脆弱性を利用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "テキストタイプのファイル（.txt、.csv、.vtt、.srt、.asc）をアップロードし、その内容を '' のような HTML ペイロードで始めることで、ブロックリストのゲートキーパーを回避できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "アップロードされたファイルはバイト内容を検査せず、text/plain とみなされるため、悪意あるスクリプトがそのまま保存されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：themefic / Ultra Addons for Contact Form 7。影響ありとして記載：3.5.54以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Ultra Addons for Contact Form 7」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103999", "https://www.wordfence.com/threat-intel/vulnerabilities/id/29b9d978-f8b0-48f9-a10e-7e61a4f4a828?source=cve", "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L901", "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L895", "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L869", "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/inc/functions.php#L1703", "https://downloads.wordpress.org/plugin/ultimate-addons-for-contact-form-7.zip", "https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-103999" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103999", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/29b9d978-f8b0-48f9-a10e-7e61a4f4a828?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L901", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L895", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/database/database.php#L869", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/inc/functions.php#L1703", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/ultimate-addons-for-contact-form-7.zip", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7/trunk/addons/database/database.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103999", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "sourceField": "/containers/cna/title", "excerpt": "Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The extension blocklist gatekeeper is bypassed by uploading text-type files (.txt, .csv, .vtt, .srt, .asc) whose contents begin with an HTML payload such as '', as the check classifies these files as text/plain without inspecting their byte content.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103999.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"themefic\",\"product\":\"Ultra Addons for Contact Form 7\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.5.54\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103999（Ultra Addons for Contact Form 7）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは、Ultra Addons for Contact Form 7 のバージョン 0（プレースホルダー）から 3.5.54 までのすべてのバージョンです。\n・認証されていない攻撃者でもこの脆弱性を利用できます。\n・テキストタイプのファイル（.txt、.csv、.vtt、.srt、.asc）をアップロードし、その内容を '' のような HTML ペイロードで始めることで、ブロックリストのゲートキーパーを回避できます。\n・アップロードされたファイルはバイト内容を検査せず、text/plain とみなされるため、悪意あるスクリプトがそのまま保存されます。\n・公式の対象表：themefic / Ultra Addons for Contact Form 7。影響ありとして記載：3.5.54以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103999", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:48.730Z", "lastSuccess": "2026-10-23T03:20:48.730Z", "sourceCheckedAt": "2026-10-23T02:43:41.332Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-103896", "aliases": [], "title": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer：ファイルへの不正アクセス", "summary": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer プラグイン（WordPress 用）は、バージョン 2.34.5 までに、ページキャッシュのパスに対するクエリ文字列パラメータのパストラバーサルにより、認証されていない攻撃者が限定的にファイルを書き込める脆弱性があります。OptimizerWebPageCache::get_cache_file_dir() が生の $_GET の名前と値をそのままディスク上のキャッシュパスに結合し、cache_content() が realpath のチェックなしに mkdir() と file_put_contents() を実行するためです。この結果、キャッシュルート外に任意のディレクトリ（モード 0777、再帰的）を作成し、その中に 'source.html' という固定名のキャッシュページを書き込むことが可能になります。ただし、書き込めるのは PHP ファイルではなく、攻撃者が提供したデータではなくページのレンダリング結果です。", "risk": "キャッシュ汚染が起こり、任意のディレクトリが作成される可能性がありますが、PHP ファイルの書き込みやコード実行はできません。", "product": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "affected": [ { "product": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer", "range": "<= 2.34.5" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103896", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83e672e7-2483-46e9-ae16-a9e7ccc4bcb8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L205", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L190", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L312", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageValidations.php#L299", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103896", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:24.365Z", "modifiedAt": "2026-10-16T15:17:02.663Z", "fetchedAt": "2026-10-23T02:43:41.278Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.", "sourceTitle": "10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "10web", "product": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "2.34.5", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103896", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "fetchedAt": "2026-10-23T02:43:41.278Z", "publishedAt": "2026-10-16T05:30:24.365Z", "modifiedAt": "2026-10-16T15:09:39.142Z", "state": "published", "provider": "Wordfence", "title": "10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path", "descriptions": [ { "lang": "en", "value": "The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "10web", "product": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.34.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83e672e7-2483-46e9-ae16-a9e7ccc4bcb8?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L205", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L190", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L312", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageValidations.php#L299", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"10web\",\"product\":\"10Web Booster – Website speed optimization, Cache & Page Speed optimizer\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.34.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"cweId\":\"CWE-22\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:39.142Z", "fetchedAt": "2026-10-23T02:43:41.278Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.663Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "10Web Booster – Website speed optimization, Cache & Page Speed optimizerにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:49.200Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ad7da2f58de1cbc23f1cda5e07bfcf8faa4df3c91deaff32551d6d00df0ccea4", "sourceModifiedAt": "2026-10-16T15:17:02.663Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer プラグイン（WordPress 用）は、バージョン 2.34.5 までに、ページキャッシュのパスに対するクエリ文字列パラメータのパストラバーサルにより、認証されていない攻撃者が限定的にファイルを書き込める脆弱性があります。OptimizerWebPageCache::get_cache_file_dir() が生の $_GET の名前と値をそのままディスク上のキャッシュパスに結合し、cache_content() が realpath のチェックなしに mkdir() と file_put_contents() を実行するためです。この結果、キャッシュルート外に任意のディレクトリ（モード 0777、再帰的）を作成し、その中に 'source.html' という固定名のキャッシュページを書き込むことが可能になります。ただし、書き込めるのは PHP ファイルではなく、攻撃者が提供したデータではなくページのレンダリング結果です。", "risk": "キャッシュ汚染が起こり、任意のディレクトリが作成される可能性がありますが、PHP ファイルの書き込みやコード実行はできません。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "WordPress 用プラグイン 10Web Booster のバージョン 2.34.5 以下が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者は認証されていなくても利用可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "影響は OptimizerWebPageCache::get_cache_file_dir() が生の $_GET パラメータをサニタイズせずにキャッシュパスに結合する点にあります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "cache_content() が realpath のチェックを行わずに mkdir() と file_put_contents() を実行するため、キャッシュルート外にディレクトリを作成できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "作成されるディレクトリはモード 0777 で再帰的に作成されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "書き込まれるファイル名は常に 'source.html' に固定され、拡張子も固定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "書き込まれる内容はページのレンダリング結果であり、攻撃者が任意のデータを入れることはできません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "PHP ファイルは書き込めないため、コード実行は不可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：10web / 10Web Booster – Website speed optimization, Cache & Page Speed optimizer。影響ありとして記載：2.34.5以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「10Web Booster – Website speed optimization, Cache & Page Speed optimizer」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103896", "https://www.wordfence.com/threat-intel/vulnerabilities/id/83e672e7-2483-46e9-ae16-a9e7ccc4bcb8?source=cve", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L205", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L190", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L312", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageValidations.php#L299", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8", "https://nvd.nist.gov/vuln/detail/CVE-2026-103896" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103896", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83e672e7-2483-46e9-ae16-a9e7ccc4bcb8?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L205", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L190", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageCache.php#L312", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.5/includes/WebPageCache/OptimizerWebPageValidations.php#L299", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103896", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "sourceField": "/containers/cna/title", "excerpt": "10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103896.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"10web\",\"product\":\"10Web Booster – Website speed optimization, Cache & Page Speed optimizer\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.34.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103896（10Web Booster – Website speed optimization, Cache & Page Speed optimizer）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPress 用プラグイン 10Web Booster のバージョン 2.34.5 以下が影響を受けます。\n・攻撃者は認証されていなくても利用可能です。\n・影響は OptimizerWebPageCache::get_cache_file_dir() が生の $_GET パラメータをサニタイズせずにキャッシュパスに結合する点にあります。\n・cache_content() が realpath のチェックを行わずに mkdir() と file_put_contents() を実行するため、キャッシュルート外にディレクトリを作成できます。\n・作成されるディレクトリはモード 0777 で再帰的に作成されます。\n・書き込まれるファイル名は常に 'source.html' に固定され、拡張子も固定です。\n・書き込まれる内容はページのレンダリング結果であり、攻撃者が任意のデータを入れることはできません。\n・PHP ファイルは書き込めないため、コード実行は不可能です。\n・公式の対象表：10web / 10Web Booster – Website speed optimization, Cache & Page Speed optimizer。影響ありとして記載：2.34.5以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103896", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:49.200Z", "lastSuccess": "2026-10-23T03:20:49.200Z", "sourceCheckedAt": "2026-10-23T02:43:41.278Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-103768", "aliases": [], "title": "ELEX WordPress HelpDesk & Customer Ticketing System：コード実行", "summary": "ELEX WordPress HelpDesk & Customer Ticketing System プラグインは、バージョン3.3.7までのすべてのバージョンで、initMailPart 関数が IMAP メールの添付ファイルを保存する際にファイル種別の検証が不十分です。そのため、認証されていない攻撃者が実行可能なファイルをアップロードでき、リモートコード実行が可能になります。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "product": "ELEX WordPress HelpDesk & Customer Ticketing System", "category": "wordpress", "component": "plugin", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "ELEX WordPress HelpDesk & Customer Ticketing System", "range": "<= 3.3.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103768", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103768", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:25.043Z", "modifiedAt": "2026-10-16T15:17:02.553Z", "fetchedAt": "2026-10-23T02:43:41.272Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.", "sourceTitle": "ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "elextensions", "product": "ELEX WordPress HelpDesk & Customer Ticketing System", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.3.7", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103768", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "fetchedAt": "2026-10-23T02:43:41.272Z", "publishedAt": "2026-10-16T05:30:25.043Z", "modifiedAt": "2026-10-16T15:09:38.837Z", "state": "published", "provider": "Wordfence", "title": "ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment", "descriptions": [ { "lang": "en", "value": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "elextensions", "product": "ELEX WordPress HelpDesk & Customer Ticketing System", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.3.7", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"elextensions\",\"product\":\"ELEX WordPress HelpDesk & Customer Ticketing System\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-434 Unrestricted Upload of File with Dangerous Type\",\"cweId\":\"CWE-434\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:38.837Z", "fetchedAt": "2026-10-23T02:43:41.272Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.553Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "ELEX WordPress HelpDesk & Customer Ticketing Systemにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:49.424Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8d3f72851d92c2b142ccf419200a7e390e50b57a08d09ddeeb8d200724828695", "sourceModifiedAt": "2026-10-16T15:17:02.553Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "ELEX WordPress HelpDesk & Customer Ticketing System プラグインは、バージョン3.3.7までのすべてのバージョンで、initMailPart 関数が IMAP メールの添付ファイルを保存する際にファイル種別の検証が不十分です。そのため、認証されていない攻撃者が実行可能なファイルをアップロードでき、リモートコード実行が可能になります。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は ELEX WordPress HelpDesk & Customer Ticketing System プラグインで、バージョン3.3.7以下のすべてのバージョンです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証されていない攻撃者が IMAP メールの添付ファイルを利用して任意のファイルをアップロードできます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：elextensions / ELEX WordPress HelpDesk & Customer Ticketing System。影響ありとして記載：3.3.7以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「ELEX WordPress HelpDesk & Customer Ticketing System」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103768", "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7", "https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-103768" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103768", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103768", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "sourceField": "/containers/cna/title", "excerpt": "ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103768.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"elextensions\",\"product\":\"ELEX WordPress HelpDesk & Customer Ticketing System\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103768（ELEX WordPress HelpDesk & Customer Ticketing System）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は ELEX WordPress HelpDesk & Customer Ticketing System プラグインで、バージョン3.3.7以下のすべてのバージョンです。\n・認証されていない攻撃者が IMAP メールの添付ファイルを利用して任意のファイルをアップロードできます。\n・公式の対象表：elextensions / ELEX WordPress HelpDesk & Customer Ticketing System。影響ありとして記載：3.3.7以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103768", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:49.424Z", "lastSuccess": "2026-10-23T03:20:49.424Z", "sourceCheckedAt": "2026-10-23T02:43:41.272Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-103480", "aliases": [], "title": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental：ブラウザー上での不正な処理", "summary": "Tourfic プラグイン（バージョン 3.0.1 以下）において、認証済みの contributor 以上の権限を持つ攻撃者がショートコード属性 'type' に任意のスクリプトを保存できるため、ページを閲覧したユーザーのブラウザーで不正な処理が実行されます。wp_kses_post フィルタは角括弧が不要なペイロードを除去しないため、エスケープされていない属性値が保存され、未認証のゲストがページを表示した際にライブイベントハンドラとして発火します。", "risk": "ユーザーのブラウザーで不正なスクリプトが実行され、ページ上で任意の操作が行われる可能性があります。", "product": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental", "range": "<= 3.0.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103480", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34466168-c03c-430e-9aba-daf718cbc9ad?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L25", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L19", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/tourfic.3.0.2.zip", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103480", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:20.709Z", "modifiedAt": "2026-10-16T16:16:53.123Z", "fetchedAt": "2026-10-23T02:43:41.040Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on save does not strip the payload because angle-bracket characters are not required, allowing the unescaped attribute value to survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.", "sourceTitle": "Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "themefic", "product": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.0.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103480", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "fetchedAt": "2026-10-23T02:43:41.040Z", "publishedAt": "2026-10-16T05:30:20.709Z", "modifiedAt": "2026-10-16T15:48:35.785Z", "state": "published", "provider": "Wordfence", "title": "Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute", "descriptions": [ { "lang": "en", "value": "The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on save does not strip the payload because angle-bracket characters are not required, allowing the unescaped attribute value to survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "themefic", "product": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.0.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34466168-c03c-430e-9aba-daf718cbc9ad?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L25", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L19", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://downloads.wordpress.org/plugin/tourfic.3.0.2.zip", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"themefic\",\"product\":\"Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.0.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on save does not strip the payload because angle-bracket characters are not required, allowing the unescaped attribute value to survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:48:35.785Z", "fetchedAt": "2026-10-23T02:43:41.040Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:16:53.123Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rentalにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:50.402Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f7a5873844b2fbad109f54fd000ee96e314b6725782dae6fda6545db23c54d07", "sourceModifiedAt": "2026-10-16T16:16:53.123Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Tourfic プラグイン（バージョン 3.0.1 以下）において、認証済みの contributor 以上の権限を持つ攻撃者がショートコード属性 'type' に任意のスクリプトを保存できるため、ページを閲覧したユーザーのブラウザーで不正な処理が実行されます。wp_kses_post フィルタは角括弧が不要なペイロードを除去しないため、エスケープされていない属性値が保存され、未認証のゲストがページを表示した際にライブイベントハンドラとして発火します。", "risk": "ユーザーのブラウザーで不正なスクリプトが実行され、ページ上で任意の操作が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象プラグインは「Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental」である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "影響を受けるバージョンは 3.0.1 以下（3.0.1 を含む）である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "攻撃者は WordPress の contributor 以上の権限で認証済みである必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "脆弱性はショートコード属性 'type' に対する入力に起因する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "保存時に wp_kses_post フィルタが適用されるが、角括弧が不要なためペイロードが除去されない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "エスケープされていない属性値が保存され、未認証のゲストがページを表示した際にライブイベントハンドラとして実行される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：themefic / Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental。影響ありとして記載：3.0.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103480", "https://www.wordfence.com/threat-intel/vulnerabilities/id/34466168-c03c-430e-9aba-daf718cbc9ad?source=cve", "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L25", "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L19", "https://downloads.wordpress.org/plugin/tourfic.3.0.2.zip", "https://nvd.nist.gov/vuln/detail/CVE-2026-103480" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103480", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34466168-c03c-430e-9aba-daf718cbc9ad?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L25", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/tourfic/tags/3.0.0/inc/App/Shortcodes/Wishlist.php#L19", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/tourfic.3.0.2.zip", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103480", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "sourceField": "/containers/cna/title", "excerpt": "Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on save does not strip the payload because angle-bracket characters are not required, allowing the unescaped attribute value to survive storage and fire as a live event handler in the unauthenticated (guest) rendering branch.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103480.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"themefic\",\"product\":\"Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.0.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103480（Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは「Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental」である。\n・影響を受けるバージョンは 3.0.1 以下（3.0.1 を含む）である。\n・攻撃者は WordPress の contributor 以上の権限で認証済みである必要がある。\n・脆弱性はショートコード属性 'type' に対する入力に起因する。\n・保存時に wp_kses_post フィルタが適用されるが、角括弧が不要なためペイロードが除去されない。\n・エスケープされていない属性値が保存され、未認証のゲストがページを表示した際にライブイベントハンドラとして実行される。\n・公式の対象表：themefic / Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental。影響ありとして記載：3.0.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103480", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:50.402Z", "lastSuccess": "2026-10-23T03:20:50.402Z", "sourceCheckedAt": "2026-10-23T02:43:41.040Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-100186", "aliases": [], "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor：ブラウザー上での不正な処理", "summary": "User Profile Builder プラグインは、バージョン4.0.3までで、First Name フィールドの入力が十分にサニタイズ・エスケープされていないため、未認証の攻撃者が任意のウェブスクリプトを保存でき、Email Confirmation 機能が有効な場合に、スクリプトが埋め込まれたページをユーザーが閲覧すると実行されます。", "risk": "攻撃者が埋め込んだスクリプトがユーザーのブラウザーで実行される可能性があります。", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "range": "<= 4.0.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-100186", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f2ecdb-bbd0-4834-b731-88724ca0dfd7?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L99", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L100", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/first-name/first-name.php#L56", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L470", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/class-email-confirmation.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100186", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:28.153Z", "modifiedAt": "2026-10-16T15:16:58.640Z", "fetchedAt": "2026-10-23T02:43:40.764Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.", "sourceTitle": "User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.0.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-100186", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "fetchedAt": "2026-10-23T02:43:40.764Z", "publishedAt": "2026-10-16T05:30:28.153Z", "modifiedAt": "2026-10-16T14:39:03.586Z", "state": "published", "provider": "Wordfence", "title": "User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field", "descriptions": [ { "lang": "en", "value": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.0.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f2ecdb-bbd0-4834-b731-88724ca0dfd7?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L99", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L100", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/first-name/first-name.php#L56", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L470", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/class-email-confirmation.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:03.586Z", "fetchedAt": "2026-10-23T02:43:40.764Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:16:58.640Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editorにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:51.221Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "85db794e4f294ea96bf4fbdb5ef0c63731fbd312ed23e23721a3375fd4740589", "sourceModifiedAt": "2026-10-16T15:16:58.640Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "User Profile Builder プラグインは、バージョン4.0.3までで、First Name フィールドの入力が十分にサニタイズ・エスケープされていないため、未認証の攻撃者が任意のウェブスクリプトを保存でき、Email Confirmation 機能が有効な場合に、スクリプトが埋め込まれたページをユーザーが閲覧すると実行されます。", "risk": "攻撃者が埋め込んだスクリプトがユーザーのブラウザーで実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "User Profile Builder プラグインのバージョンが 4.0.3 以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Email Confirmation 機能が有効になっていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "First Name フィールドに入力されたデータが適切にサニタイズ・エスケープされていないこと。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は認証されていない状態でスクリプトを注入できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-100186", "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f2ecdb-bbd0-4834-b731-88724ca0dfd7?source=cve", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L99", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L100", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/first-name/first-name.php#L56", "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L470", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/class-email-confirmation.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-100186" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-100186", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f2ecdb-bbd0-4834-b731-88724ca0dfd7?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L99", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L100", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/first-name/first-name.php#L56", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L470", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/class-email-confirmation.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100186", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "sourceField": "/containers/cna/title", "excerpt": "User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100186.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"cozmoslabs\",\"product\":\"User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-100186（User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・User Profile Builder プラグインのバージョンが 4.0.3 以下であること。\n・Email Confirmation 機能が有効になっていること。\n・First Name フィールドに入力されたデータが適切にサニタイズ・エスケープされていないこと。\n・攻撃者は認証されていない状態でスクリプトを注入できること。\n・公式の対象表：cozmoslabs / User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor。影響ありとして記載：4.0.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-100186", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:51.221Z", "lastSuccess": "2026-10-23T03:20:51.221Z", "sourceCheckedAt": "2026-10-23T02:43:40.764Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-100158", "aliases": [], "title": "SQL Chart Builder：ブラウザー上での不正な処理", "summary": "SQL Chart Builder プラグイン（バージョン 3.0.6 以下）は、'X 軸列の値 ($value->$xarg_s from $wpdb->get_results())' パラメータの入力サニタイズと出力エスケープが不十分なため、保存型クロスサイトスクリプティング（XSS）の脆弱性があります。認証済みの攻撃者（購読者レベル以上）が任意のウェブスクリプトを注入でき、ページが閲覧されるたびにそのスクリプトが実行されます。この攻撃が成立するには、管理者が SQL クエリで下位権限ユーザーが制御できる列（例: wp_users.display_name）を返すチャートを公開している必要があり、購読者は標準のプロフィールページ (/wp-admin/profile.php) でその列にペイロードを設定できます。", "risk": "注入されたウェブスクリプトが実行され、ページを閲覧したユーザーのブラウザーで不正な処理が動かされる可能性があります。", "product": "SQL Chart Builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "SQL Chart Builder", "range": "<= 3.0.6" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-100158", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16375398-c5c9-465f-9a2f-4c08f76b090b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L579", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1093", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1019", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1101", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L820", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3725657%40sql-chart-builder&new=3725657%40sql-chart-builder", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100158", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T05:30:19.302Z", "modifiedAt": "2026-10-16T15:16:57.950Z", "fetchedAt": "2026-10-23T02:43:40.676Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.", "sourceTitle": "SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "elvinhaci", "product": "SQL Chart Builder", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.0.6", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-100158", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "fetchedAt": "2026-10-23T02:43:40.676Z", "publishedAt": "2026-10-16T05:30:19.302Z", "modifiedAt": "2026-10-16T14:39:05.141Z", "state": "published", "provider": "Wordfence", "title": "SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field", "descriptions": [ { "lang": "en", "value": "The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "elvinhaci", "product": "SQL Chart Builder", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.0.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16375398-c5c9-465f-9a2f-4c08f76b090b?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L579", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1093", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1019", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1101", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L820", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3725657%40sql-chart-builder&new=3725657%40sql-chart-builder", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"elvinhaci\",\"product\":\"SQL Chart Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.0.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:05.141Z", "fetchedAt": "2026-10-23T02:43:40.676Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:16:57.950Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "SQL Chart Builderにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:51.268Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8580a59bb163f84667359daa5f1e041e4fbba72e09217b4f7041090b276c4314", "sourceModifiedAt": "2026-10-16T15:16:57.950Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SQL Chart Builder プラグイン（バージョン 3.0.6 以下）は、'X 軸列の値 ($value->$xarg_s from $wpdb->get_results())' パラメータの入力サニタイズと出力エスケープが不十分なため、保存型クロスサイトスクリプティング（XSS）の脆弱性があります。認証済みの攻撃者（購読者レベル以上）が任意のウェブスクリプトを注入でき、ページが閲覧されるたびにそのスクリプトが実行されます。この攻撃が成立するには、管理者が SQL クエリで下位権限ユーザーが制御できる列（例: wp_users.display_name）を返すチャートを公開している必要があり、購読者は標準のプロフィールページ (/wp-admin/profile.php) でその列にペイロードを設定できます。", "risk": "注入されたウェブスクリプトが実行され、ページを閲覧したユーザーのブラウザーで不正な処理が動かされる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "SQL Chart Builder プラグインのバージョン 3.0.6 以下が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証済みの攻撃者で、購読者レベル以上の権限を持つユーザーが攻撃できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "管理者が、SQL クエリで下位権限ユーザーが制御できる列（例: wp_users.display_name）を返すチャートを公開している必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "下位権限ユーザーは、標準の WordPress プロフィールページ (/wp-admin/profile.php) でその列の値をペイロードとして設定できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：elvinhaci / SQL Chart Builder。影響ありとして記載：3.0.6以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「SQL Chart Builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-100158", "https://www.wordfence.com/threat-intel/vulnerabilities/id/16375398-c5c9-465f-9a2f-4c08f76b090b?source=cve", "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L579", "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1093", "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1019", "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1101", "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L820", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3725657%40sql-chart-builder&new=3725657%40sql-chart-builder", "https://nvd.nist.gov/vuln/detail/CVE-2026-100158" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-100158", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16375398-c5c9-465f-9a2f-4c08f76b090b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L579", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1093", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1019", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1101", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L820", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3725657%40sql-chart-builder&new=3725657%40sql-chart-builder", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100158", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "sourceField": "/containers/cna/title", "excerpt": "SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100158.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"elvinhaci\",\"product\":\"SQL Chart Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.0.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-100158（SQL Chart Builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・SQL Chart Builder プラグインのバージョン 3.0.6 以下が対象です。\n・認証済みの攻撃者で、購読者レベル以上の権限を持つユーザーが攻撃できます。\n・管理者が、SQL クエリで下位権限ユーザーが制御できる列（例: wp_users.display_name）を返すチャートを公開している必要があります。\n・下位権限ユーザーは、標準の WordPress プロフィールページ (/wp-admin/profile.php) でその列の値をペイロードとして設定できます。\n・公式の対象表：elvinhaci / SQL Chart Builder。影響ありとして記載：3.0.6以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-100158", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:51.268Z", "lastSuccess": "2026-10-23T03:20:51.268Z", "sourceCheckedAt": "2026-10-23T02:43:40.676Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" }, { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-96562", "aliases": [], "title": "Broken Link Checker：脆弱性情報", "summary": "Broken Link Checker プラグイン（バージョン 2.4.14.1 以下）において、認証されていない攻撃者がコメントにショートコードを埋め込むことで、WP‑Cron が自動的にそのショートコードを実行し、任意のショートコードを実行できる脆弱性があります。", "risk": "認証されていない攻撃者が任意のショートコードを実行でき、サイト上で予期しない処理が行われる可能性があります。", "product": "Broken Link Checker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Broken Link Checker", "range": "<= 2.4.14.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-96562", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/04cc4b99-8c27-4f95-b860-608c01af843b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/html_link.php#L72", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/image.php#L66", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/containers/comment.php#L229", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/includes/containers.php#L298", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740705%40broken-link-checker&new=3740705%40broken-link-checker", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96562", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:26:58.157Z", "modifiedAt": "2026-10-16T15:17:37.480Z", "fetchedAt": "2026-10-23T02:43:53.358Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.", "sourceTitle": "Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpmudev", "product": "Broken Link Checker", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "2.4.14.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-96562", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "fetchedAt": "2026-10-23T02:43:53.358Z", "publishedAt": "2026-10-16T04:26:58.157Z", "modifiedAt": "2026-10-16T15:09:40.737Z", "state": "published", "provider": "Wordfence", "title": "Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback", "descriptions": [ { "lang": "en", "value": "The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpmudev", "product": "Broken Link Checker", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.4.14.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/04cc4b99-8c27-4f95-b860-608c01af843b?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/html_link.php#L72", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/image.php#L66", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/containers/comment.php#L229", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/includes/containers.php#L298", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740705%40broken-link-checker&new=3740705%40broken-link-checker", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpmudev\",\"product\":\"Broken Link Checker\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.14.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-94 Improper Control of Generation of Code ('Code Injection')\",\"cweId\":\"CWE-94\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:40.737Z", "fetchedAt": "2026-10-23T02:43:53.358Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:37.480Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Broken Link Checkerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:53.578Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b57be19f102eebbb2e76241b8fefc5fa9d3cc2f2eef7669d3163cd294fea5e8b", "sourceModifiedAt": "2026-10-16T15:17:37.480Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Broken Link Checker プラグイン（バージョン 2.4.14.1 以下）において、認証されていない攻撃者がコメントにショートコードを埋め込むことで、WP‑Cron が自動的にそのショートコードを実行し、任意のショートコードを実行できる脆弱性があります。", "risk": "認証されていない攻撃者が任意のショートコードを実行でき、サイト上で予期しない処理が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象プラグインのバージョンが 2.4.14.1 以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "攻撃者は認証されていないユーザーであること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "コメント投稿時に href または src 属性にショートコードを含めたペイロードを記述できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "そのコメントがサイトの通常のコメント承認フローを通過し、承認されること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "承認後、WP‑Cron が自動的に do_shortcode を呼び出し、ショートコードが実行されること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：wpmudev / Broken Link Checker。影響ありとして記載：2.4.14.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Broken Link Checker」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-96562", "https://www.wordfence.com/threat-intel/vulnerabilities/id/04cc4b99-8c27-4f95-b860-608c01af843b?source=cve", "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/html_link.php#L72", "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/image.php#L66", "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/containers/comment.php#L229", "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/includes/containers.php#L298", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740705%40broken-link-checker&new=3740705%40broken-link-checker", "https://nvd.nist.gov/vuln/detail/CVE-2026-96562" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-96562", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/04cc4b99-8c27-4f95-b860-608c01af843b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/html_link.php#L72", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/parsers/image.php#L66", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/modules/containers/comment.php#L229", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.14.1/legacy/includes/containers.php#L298", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3740705%40broken-link-checker&new=3740705%40broken-link-checker", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96562", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "sourceField": "/containers/cna/title", "excerpt": "Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96562.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpmudev\",\"product\":\"Broken Link Checker\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.14.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-96562（Broken Link Checker）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインのバージョンが 2.4.14.1 以下であること。\n・攻撃者は認証されていないユーザーであること。\n・コメント投稿時に href または src 属性にショートコードを含めたペイロードを記述できること。\n・そのコメントがサイトの通常のコメント承認フローを通過し、承認されること。\n・承認後、WP‑Cron が自動的に do_shortcode を呼び出し、ショートコードが実行されること。\n・公式の対象表：wpmudev / Broken Link Checker。影響ありとして記載：2.4.14.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-96562", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:53.578Z", "lastSuccess": "2026-10-23T03:20:53.578Z", "sourceCheckedAt": "2026-10-23T02:43:53.358Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-111114", "aliases": [], "title": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit：権限の奪取", "summary": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit プラグインは、バージョン 4.7.11 までのすべてのバージョンで特権昇格の脆弱性があります。`role_switcher_to_view_admin_as()` の `/?reset-view` ハンドラは、送信されたユーザー名が認証済みの呼び出し元と一致した場合に nonce や権限チェックを行いません。また、プラグインが唯一持つクリーンアップ機構である `profile_update` フックは、WordPress が管理画面のユーザー一覧から一括ロール変更（`wp-admin/users.php?action=promote`）を行う際には呼び出されず、`nxtext_view_admin_original_role` メタに残った古い `administrator` の値が削除されません。このため、Subscriber 以上の権限を持つ認証済み攻撃者が、以前に管理者ロールを保持し、View Admin Role Switcher 機能を使用した後に一括ロール変更で降格された場合、残っている管理者ロール情報を自分のアカウントに復元でき、管理者権限に昇格させることが可能になります。", "risk": "認証済みの攻撃者が自分のアカウントを管理者に昇格させることができ、サイト全体を制御できるようになる可能性があります。", "product": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit", "range": "<= 4.7.11" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-111114", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae86441d-5a95-45a7-869a-9e7872365a1f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L287", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L265", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L51", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L302", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3740891/nexter-extension/trunk/include/panel-settings/extensions/nexter-ext-view-admin-role.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111114", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:03.097Z", "modifiedAt": "2026-10-16T16:17:04.080Z", "fetchedAt": "2026-10-23T02:43:45.133Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.", "sourceTitle": "Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "posimyththemes", "product": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.7.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-111114", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "fetchedAt": "2026-10-23T02:43:45.133Z", "publishedAt": "2026-10-16T04:27:03.097Z", "modifiedAt": "2026-10-16T16:04:40.422Z", "state": "published", "provider": "Wordfence", "title": "Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter", "descriptions": [ { "lang": "en", "value": "The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "posimyththemes", "product": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.7.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae86441d-5a95-45a7-869a-9e7872365a1f?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L287", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L265", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L51", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L302", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3740891/nexter-extension/trunk/include/panel-settings/extensions/nexter-ext-view-admin-role.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"posimyththemes\",\"product\":\"Nexter Extension – Security, Performance, Code Snippets & Site Toolkit\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.7.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T16:04:40.422Z", "fetchedAt": "2026-10-23T02:43:45.133Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:17:04.080Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkitに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:54.069Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a19c83596b71a574708558768a8fdec040af6c5500b9930d184c6c819a9dc9bc", "sourceModifiedAt": "2026-10-16T16:17:04.080Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit プラグインは、バージョン 4.7.11 までのすべてのバージョンで特権昇格の脆弱性があります。`role_switcher_to_view_admin_as()` の `/?reset-view` ハンドラは、送信されたユーザー名が認証済みの呼び出し元と一致した場合に nonce や権限チェックを行いません。また、プラグインが唯一持つクリーンアップ機構である `profile_update` フックは、WordPress が管理画面のユーザー一覧から一括ロール変更（`wp-admin/users.php?action=promote`）を行う際には呼び出されず、`nxtext_view_admin_original_role` メタに残った古い `administrator` の値が削除されません。このため、Subscriber 以上の権限を持つ認証済み攻撃者が、以前に管理者ロールを保持し、View Admin Role Switcher 機能を使用した後に一括ロール変更で降格された場合、残っている管理者ロール情報を自分のアカウントに復元でき、管理者権限に昇格させることが可能になります。", "risk": "認証済みの攻撃者が自分のアカウントを管理者に昇格させることができ、サイト全体を制御できるようになる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象製品は WordPress 用プラグイン Nexter Extension – Security, Performance, Code Snippets & Site Toolkit で、バージョン 4.7.11 以下のすべてのバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：posimyththemes / Nexter Extension – Security, Performance, Code Snippets & Site Toolkit。影響ありとして記載：4.7.11以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Nexter Extension – Security, Performance, Code Snippets & Site Toolkit」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-111114", "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae86441d-5a95-45a7-869a-9e7872365a1f?source=cve", "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L287", "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L265", "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L51", "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L302", "https://plugins.trac.wordpress.org/changeset/3740891/nexter-extension/trunk/include/panel-settings/extensions/nexter-ext-view-admin-role.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-111114" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-111114", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae86441d-5a95-45a7-869a-9e7872365a1f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L287", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L265", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L51", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/nexter-extension/tags/4.7.11/include/panel-settings/extensions/nexter-ext-view-admin-role.php#L302", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3740891/nexter-extension/trunk/include/panel-settings/extensions/nexter-ext-view-admin-role.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111114", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "sourceField": "/containers/cna/title", "excerpt": "Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111114.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"posimyththemes\",\"product\":\"Nexter Extension – Security, Performance, Code Snippets & Site Toolkit\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.7.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-111114（Nexter Extension – Security, Performance, Code Snippets & Site Toolkit）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は WordPress 用プラグイン Nexter Extension – Security, Performance, Code Snippets & Site Toolkit で、バージョン 4.7.11 以下のすべてのバージョンが影響を受けます。\n・公式の対象表：posimyththemes / Nexter Extension – Security, Performance, Code Snippets & Site Toolkit。影響ありとして記載：4.7.11以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-111114", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:54.069Z", "lastSuccess": "2026-10-23T03:20:54.069Z", "sourceCheckedAt": "2026-10-23T02:43:45.133Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-111106", "aliases": [], "title": "Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance：データベースへの不正操作", "summary": "Mail Mint 1.31.4 以下のバージョンにおいて、認証済み（カスタム権限）ユーザーが 'filters' パラメータを介してSQLインジェクションを実行できる脆弱性があります。", "risk": "認証された攻撃者がデータベースから機密情報を取得できる可能性があります。", "product": "Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance", "range": "<= 1.31.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-111106", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c492357-3293-49cf-9e4a-3e144b58b6f7?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L797", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L500", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L100", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Controllers/Admin/SegmentController.php#L41", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Routes/Admin/SegmentRoute.php#L55", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L297", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743638/mail-mint/trunk/app/Internal/Admin/Segmentation/SegmentFilterService.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111106", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:26:59.962Z", "modifiedAt": "2026-10-16T15:17:13.057Z", "fetchedAt": "2026-10-23T02:43:45.075Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value. This makes it possible for authenticated attackers, with the custom 'mint_read_contacts' capability (granted to Administrators by default, and configurable to lower roles via the plugin's role manager), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "sourceTitle": "Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "getwpfunnels", "product": "Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.31.4", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-111106", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "fetchedAt": "2026-10-23T02:43:45.075Z", "publishedAt": "2026-10-16T04:26:59.962Z", "modifiedAt": "2026-10-16T15:09:40.294Z", "state": "published", "provider": "Wordfence", "title": "Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter", "descriptions": [ { "lang": "en", "value": "The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value. This makes it possible for authenticated attackers, with the custom 'mint_read_contacts' capability (granted to Administrators by default, and configurable to lower roles via the plugin's role manager), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "getwpfunnels", "product": "Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.31.4", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c492357-3293-49cf-9e4a-3e144b58b6f7?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L797", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L500", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L100", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Controllers/Admin/SegmentController.php#L41", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Routes/Admin/SegmentRoute.php#L55", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L297", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743638/mail-mint/trunk/app/Internal/Admin/Segmentation/SegmentFilterService.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"getwpfunnels\",\"product\":\"Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.31.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value. This makes it possible for authenticated attackers, with the custom 'mint_read_contacts' capability (granted to Administrators by default, and configurable to lower roles via the plugin's role manager), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"cweId\":\"CWE-89\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:40.294Z", "fetchedAt": "2026-10-23T02:43:45.075Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:13.057Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistanceにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:54.841Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "82dab11e1d5bf350c226c3c763dc1e5f8479f4d82151fb62f537bbfe9d77d712", "sourceModifiedAt": "2026-10-16T15:17:13.057Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Mail Mint 1.31.4 以下のバージョンにおいて、認証済み（カスタム権限）ユーザーが 'filters' パラメータを介してSQLインジェクションを実行できる脆弱性があります。", "risk": "認証された攻撃者がデータベースから機密情報を取得できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象プラグインは WordPress 用の Mail Mint（バージョン 1.31.4 以下）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "影響を受けるバージョンは 1.31.4 までのすべてのリリースです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "攻撃は認証済みユーザーで、カスタム権限 'mint_read_contacts' を持つ者に限られます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "デフォルトではこの権限は管理者に付与されており、プラグインのロールマネージャーで他の役割に割り当てることが可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "脆弱性は REST エンドポイント /wp-json/mrm/v1/segments/contacts の 'filters' パラメータで発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "SQL クエリの組み立て時に、ユーザー提供の filter 'value' が数値コンテキストでクオートされずに文字列挿入され、$wpdb->prepare がその値を保護しません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：getwpfunnels / Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance。影響ありとして記載：1.31.4以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-111106", "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c492357-3293-49cf-9e4a-3e144b58b6f7?source=cve", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L797", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L500", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L100", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Controllers/Admin/SegmentController.php#L41", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Routes/Admin/SegmentRoute.php#L55", "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L297", "https://plugins.trac.wordpress.org/changeset/3743638/mail-mint/trunk/app/Internal/Admin/Segmentation/SegmentFilterService.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-111106" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-111106", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c492357-3293-49cf-9e4a-3e144b58b6f7?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L797", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L500", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L100", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Controllers/Admin/SegmentController.php#L41", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/API/Routes/Admin/SegmentRoute.php#L55", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mail-mint/tags/1.31.4/app/Internal/Admin/Segmentation/SegmentFilterService.php#L297", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743638/mail-mint/trunk/app/Internal/Admin/Segmentation/SegmentFilterService.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111106", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "sourceField": "/containers/cna/title", "excerpt": "Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in SegmentFilterService::get_meta_join_query() at line 797, where the value is string-interpolated into the WHERE fragment in a numeric (unquoted) context and the surrounding $wpdb->prepare() calls do not cover the injected value. This makes it possible for authenticated attackers, with the custom 'mint_read_contacts' capability (granted to Administrators by default, and configurable to lower roles via the plugin's role manager), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111106.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"getwpfunnels\",\"product\":\"Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.31.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-111106（Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは WordPress 用の Mail Mint（バージョン 1.31.4 以下）です。\n・影響を受けるバージョンは 1.31.4 までのすべてのリリースです。\n・攻撃は認証済みユーザーで、カスタム権限 'mint_read_contacts' を持つ者に限られます。\n・デフォルトではこの権限は管理者に付与されており、プラグインのロールマネージャーで他の役割に割り当てることが可能です。\n・脆弱性は REST エンドポイント /wp-json/mrm/v1/segments/contacts の 'filters' パラメータで発生します。\n・SQL クエリの組み立て時に、ユーザー提供の filter 'value' が数値コンテキストでクオートされずに文字列挿入され、$wpdb->prepare がその値を保護しません。\n・公式の対象表：getwpfunnels / Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance。影響ありとして記載：1.31.4以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-111106", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:54.841Z", "lastSuccess": "2026-10-23T03:20:54.841Z", "sourceCheckedAt": "2026-10-23T02:43:45.075Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-110721", "aliases": [], "title": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar：脆弱性情報", "summary": "NotificationX 3.3.3 以下のバージョンでは、認可が行われないため、'nx_id' パラメータを介した任意のコンテンツ注入が可能です。", "risk": "認証されていない攻撃者が偽のソーシャルプルーフ情報（名前、タイトル、メッセージ、メール、テーマ）を任意の有効化された非ポップアップ NotificationX キャンペーンに挿入できる可能性があります。", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "range": "<= 3.3.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110721", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84b5e044-4522-480a-ad14-8886ed691a86?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1161", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/Extension.php#L668", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L58", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L186", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Admin/Entries.php#L93", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746251/notificationx/trunk/includes/Extensions/PopupNotification/PopupNotification.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110721", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:00.768Z", "modifiedAt": "2026-10-16T15:17:11.883Z", "fetchedAt": "2026-10-23T02:43:44.907Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.", "sourceTitle": "NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpdevteam", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.3.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-110721", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "fetchedAt": "2026-10-23T02:43:44.907Z", "publishedAt": "2026-10-16T04:27:00.768Z", "modifiedAt": "2026-10-16T15:09:39.990Z", "state": "published", "provider": "Wordfence", "title": "NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route", "descriptions": [ { "lang": "en", "value": "The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpdevteam", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.3.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84b5e044-4522-480a-ad14-8886ed691a86?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1161", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/Extension.php#L668", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L58", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L186", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Admin/Entries.php#L93", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746251/notificationx/trunk/includes/Extensions/PopupNotification/PopupNotification.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpdevteam\",\"product\":\"NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-862 Missing Authorization\",\"cweId\":\"CWE-862\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:39.990Z", "fetchedAt": "2026-10-23T02:43:44.907Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:11.883Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Barに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:55.045Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "74d9baac0390715c13da66c2e7365b1ba2e7b5405ec41225082e404693ca8b82", "sourceModifiedAt": "2026-10-16T15:17:11.883Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NotificationX 3.3.3 以下のバージョンでは、認可が行われないため、'nx_id' パラメータを介した任意のコンテンツ注入が可能です。", "risk": "認証されていない攻撃者が偽のソーシャルプルーフ情報（名前、タイトル、メッセージ、メール、テーマ）を任意の有効化された非ポップアップ NotificationX キャンペーンに挿入できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象は NotificationX プラグインのバージョン 3.3.3 以下です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "WordPress 環境で本プラグインがインストールされていることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "/notificationx/v1/popup-submit という REST ルートが登録されています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "当該 REST ルートの permission_callback が '__return_true' に設定されており、認可が行われません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "ハンドラ PopupNotification::handle_popup_submission() が攻撃者制御可能な nx_id パラメータを受け取ります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "nx_id が指す NotificationX キャンペーンが読み込まれ、そのキャンペーンのソースが検証なしに新規エントリにコピーされます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "コピー先がポップアップ通知またはエグジットインテントポップアップであるかの確認が行われません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：wpdevteam / NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar。影響ありとして記載：3.3.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-110721", "https://www.wordfence.com/threat-intel/vulnerabilities/id/84b5e044-4522-480a-ad14-8886ed691a86?source=cve", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1161", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/Extension.php#L668", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L58", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L186", "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Admin/Entries.php#L93", "https://plugins.trac.wordpress.org/changeset/3746251/notificationx/trunk/includes/Extensions/PopupNotification/PopupNotification.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-110721" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110721", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84b5e044-4522-480a-ad14-8886ed691a86?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1161", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/Extension.php#L668", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L58", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L186", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Admin/Entries.php#L93", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3746251/notificationx/trunk/includes/Extensions/PopupNotification/PopupNotification.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110721", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "sourceField": "/containers/cna/title", "excerpt": "NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110721.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpdevteam\",\"product\":\"NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.3.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-110721（NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は NotificationX プラグインのバージョン 3.3.3 以下です。\n・WordPress 環境で本プラグインがインストールされていることが前提です。\n・/notificationx/v1/popup-submit という REST ルートが登録されています。\n・当該 REST ルートの permission_callback が '__return_true' に設定されており、認可が行われません。\n・ハンドラ PopupNotification::handle_popup_submission() が攻撃者制御可能な nx_id パラメータを受け取ります。\n・nx_id が指す NotificationX キャンペーンが読み込まれ、そのキャンペーンのソースが検証なしに新規エントリにコピーされます。\n・コピー先がポップアップ通知またはエグジットインテントポップアップであるかの確認が行われません。\n・公式の対象表：wpdevteam / NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar。影響ありとして記載：3.3.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-110721", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:55.045Z", "lastSuccess": "2026-10-23T03:20:55.045Z", "sourceCheckedAt": "2026-10-23T02:43:44.907Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-110590", "aliases": [], "title": "Klarna for WooCommerce：情報の漏えい", "summary": "Klarna for WooCommerce プラグイン（WordPress 用）は、バージョン 4.13.3 までのすべてのバージョンで、ユーザーが操作を行う権限があるか正しく確認しないため、認証されていない攻撃者が 'order-pay' エンドポイントを通じて任意の注文の secret order_key と請求・配送に関する個人情報（氏名、メールアドレス、電話番号、住所、郵便番号、都市、地域、国）を取得できる脆弱性があります。WooCommerce の注文 ID が連番であることと、order_key や認証済みセッションが不要であることから、順番に GET リクエストを送るだけで店舗内のすべての注文を列挙できます。", "risk": "認証されていない攻撃者が注文の secret order_key と顧客の氏名・メールアドレス・電話番号・住所などの個人情報を取得でき、店舗全体の注文情報が漏洩する可能性があります。", "product": "Klarna for WooCommerce", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "Klarna for WooCommerce", "range": "<= 4.13.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110590", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3abb96e-6ee2-4992-a122-9f661da9a4d6?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L185", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L198", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L204", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L159", "label": "security@wordfence.com" }, { "url": "https://github.com/krokedil/klarna-payments-for-woocommerce/compare/4.13.3...f5362605a9901b7f9264cfa3b22fd782a7a3097b", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3740915/klarna-payments-for-woocommerce/trunk/classes/class-kp-assets.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110590", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:03.790Z", "modifiedAt": "2026-10-16T15:17:11.547Z", "fetchedAt": "2026-10-23T02:43:44.728Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.", "sourceTitle": "Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "klarnaplugin", "product": "Klarna for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.13.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-110590", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "fetchedAt": "2026-10-23T02:43:44.728Z", "publishedAt": "2026-10-16T04:27:03.790Z", "modifiedAt": "2026-10-16T15:09:39.428Z", "state": "published", "provider": "Wordfence", "title": "Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint", "descriptions": [ { "lang": "en", "value": "The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "klarnaplugin", "product": "Klarna for WooCommerce", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.13.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3abb96e-6ee2-4992-a122-9f661da9a4d6?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L185", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L198", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L204", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L159", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://github.com/krokedil/klarna-payments-for-woocommerce/compare/4.13.3...f5362605a9901b7f9264cfa3b22fd782a7a3097b", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset/3740915/klarna-payments-for-woocommerce/trunk/classes/class-kp-assets.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"klarnaplugin\",\"product\":\"Klarna for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.13.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-862 Missing Authorization\",\"cweId\":\"CWE-862\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:39.428Z", "fetchedAt": "2026-10-23T02:43:44.728Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:11.547Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Klarna for WooCommerceに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:55.531Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3a245e376785aa97fbe8fd673aba2a28b17da087431396c5953dd5e1c83df1cd", "sourceModifiedAt": "2026-10-16T15:17:11.547Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Klarna for WooCommerce プラグイン（WordPress 用）は、バージョン 4.13.3 までのすべてのバージョンで、ユーザーが操作を行う権限があるか正しく確認しないため、認証されていない攻撃者が 'order-pay' エンドポイントを通じて任意の注文の secret order_key と請求・配送に関する個人情報（氏名、メールアドレス、電話番号、住所、郵便番号、都市、地域、国）を取得できる脆弱性があります。WooCommerce の注文 ID が連番であることと、order_key や認証済みセッションが不要であることから、順番に GET リクエストを送るだけで店舗内のすべての注文を列挙できます。", "risk": "認証されていない攻撃者が注文の secret order_key と顧客の氏名・メールアドレス・電話番号・住所などの個人情報を取得でき、店舗全体の注文情報が漏洩する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは、Klarna for WooCommerce プラグインのバージョン 4.13.3 以下（4.13.3 を含む）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "この脆弱性は、WordPress 上で動作する Klarna for WooCommerce プラグイン全体に存在します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者は認証されていなくても、'order-pay' エンドポイントに対して GET リクエストを送るだけで任意の注文情報にアクセスできます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "注文情報は、JavaScript 変数 klarna_payments_params としてページ内にインラインで出力されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "WooCommerce の注文 ID は連続した整数であるため、順番にリクエストすれば全注文を簡単に列挙できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：klarnaplugin / Klarna for WooCommerce。影響ありとして記載：4.13.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Klarna for WooCommerce」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-110590", "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3abb96e-6ee2-4992-a122-9f661da9a4d6?source=cve", "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L185", "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L198", "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L204", "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L159", "https://github.com/krokedil/klarna-payments-for-woocommerce/compare/4.13.3...f5362605a9901b7f9264cfa3b22fd782a7a3097b", "https://plugins.trac.wordpress.org/changeset/3740915/klarna-payments-for-woocommerce/trunk/classes/class-kp-assets.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-110590" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110590", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3abb96e-6ee2-4992-a122-9f661da9a4d6?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L185", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L198", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L204", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L159", "label": "security@wordfence.com" }, { "url": "https://github.com/krokedil/klarna-payments-for-woocommerce/compare/4.13.3...f5362605a9901b7f9264cfa3b22fd782a7a3097b", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3740915/klarna-payments-for-woocommerce/trunk/classes/class-kp-assets.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110590", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "sourceField": "/containers/cna/title", "excerpt": "Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110590.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"klarnaplugin\",\"product\":\"Klarna for WooCommerce\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.13.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-110590（Klarna for WooCommerce）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは、Klarna for WooCommerce プラグインのバージョン 4.13.3 以下（4.13.3 を含む）です。\n・この脆弱性は、WordPress 上で動作する Klarna for WooCommerce プラグイン全体に存在します。\n・攻撃者は認証されていなくても、'order-pay' エンドポイントに対して GET リクエストを送るだけで任意の注文情報にアクセスできます。\n・注文情報は、JavaScript 変数 klarna_payments_params としてページ内にインラインで出力されます。\n・WooCommerce の注文 ID は連続した整数であるため、順番にリクエストすれば全注文を簡単に列挙できます。\n・公式の対象表：klarnaplugin / Klarna for WooCommerce。影響ありとして記載：4.13.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-110590", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:55.531Z", "lastSuccess": "2026-10-23T03:20:55.531Z", "sourceCheckedAt": "2026-10-23T02:43:44.728Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-110019", "aliases": [], "title": "Bulk Page Generator – LPagery：脆弱性情報", "summary": "Bulk Page Generator – LPagery プラグイン（WordPress 用）は、バージョン 3.1.0 までのすべてのバージョンで、ユーザーが操作を実行する権限があるか正しく確認しないため、認証済みの攻撃者（サブスクライバー以上）が管理者専用とされている LPagery 管理ページや一括ページ生成プロセスを作成、変更、削除できる認可バイパスの脆弱性があります。また、Freemius を有効にしていないデフォルトの新規インストールでは、Bearer トークンの検証に使用される AES-256-CBC 鍵が空文字列の SHA-256 ハッシュに固定されるため、認証済みユーザーがトークンを自由に偽造できます。", "risk": "認証済みの攻撃者がページや一括生成プロセスを勝手に作成・変更・削除できるため、サイトのコンテンツが不正に書き換えられ、運営者の意図しない情報が公開されたり削除されたりする可能性があります。", "product": "Bulk Page Generator – LPagery", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Bulk Page Generator – LPagery", "range": "<= 3.1.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110019", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b3f361-da53-42eb-b1fb-c0bfd641335b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteOAuthAuthorizeHandler.php#L11", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteRestApi.php#L416", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/TokenValidator.php#L30", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/io/hooks/AdminMenuHooks.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.1", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110019", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:04.158Z", "modifiedAt": "2026-10-16T16:17:03.573Z", "fetchedAt": "2026-10-23T02:43:44.113Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.", "sourceTitle": "Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "niklaslindemann", "product": "Bulk Page Generator – LPagery", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.1.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-110019", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "fetchedAt": "2026-10-23T02:43:44.113Z", "publishedAt": "2026-10-16T04:27:04.158Z", "modifiedAt": "2026-10-16T16:02:36.966Z", "state": "published", "provider": "Wordfence", "title": "Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow", "descriptions": [ { "lang": "en", "value": "The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "niklaslindemann", "product": "Bulk Page Generator – LPagery", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.1.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b3f361-da53-42eb-b1fb-c0bfd641335b?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteOAuthAuthorizeHandler.php#L11", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteRestApi.php#L416", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/TokenValidator.php#L30", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/io/hooks/AdminMenuHooks.php#L91", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.1", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"niklaslindemann\",\"product\":\"Bulk Page Generator – LPagery\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.1.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-862 Missing Authorization\",\"cweId\":\"CWE-862\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T16:02:36.966Z", "fetchedAt": "2026-10-23T02:43:44.113Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:17:03.573Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Bulk Page Generator – LPageryに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:56.165Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4a61fe8af79f13aaf03e638b48371ada7ffc41699c5d3328657a0e337a64e1b3", "sourceModifiedAt": "2026-10-16T16:17:03.573Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Bulk Page Generator – LPagery プラグイン（WordPress 用）は、バージョン 3.1.0 までのすべてのバージョンで、ユーザーが操作を実行する権限があるか正しく確認しないため、認証済みの攻撃者（サブスクライバー以上）が管理者専用とされている LPagery 管理ページや一括ページ生成プロセスを作成、変更、削除できる認可バイパスの脆弱性があります。また、Freemius を有効にしていないデフォルトの新規インストールでは、Bearer トークンの検証に使用される AES-256-CBC 鍵が空文字列の SHA-256 ハッシュに固定されるため、認証済みユーザーがトークンを自由に偽造できます。", "risk": "認証済みの攻撃者がページや一括生成プロセスを勝手に作成・変更・削除できるため、サイトのコンテンツが不正に書き換えられ、運営者の意図しない情報が公開されたり削除されたりする可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのはバージョン 3.1.0 までのすべての Bulk Page Generator – LPagery のバージョンです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者はサブスクライバー以上の認証済みユーザーである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "デフォルトの新規インストールで Freemius が有効化されていない場合、Bearer トークンが任意の認証済みユーザーにより偽造可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：niklaslindemann / Bulk Page Generator – LPagery。影響ありとして記載：3.1.0以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Bulk Page Generator – LPagery」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-110019", "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b3f361-da53-42eb-b1fb-c0bfd641335b?source=cve", "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteOAuthAuthorizeHandler.php#L11", "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteRestApi.php#L416", "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/TokenValidator.php#L30", "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/io/hooks/AdminMenuHooks.php#L91", "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-110019" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-110019", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b3f361-da53-42eb-b1fb-c0bfd641335b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteOAuthAuthorizeHandler.php#L11", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/SuiteRestApi.php#L416", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/suite/TokenValidator.php#L30", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.0/src/io/hooks/AdminMenuHooks.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/lpagery/tags/3.1.1", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110019", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "sourceField": "/containers/cna/title", "excerpt": "Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110019.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"niklaslindemann\",\"product\":\"Bulk Page Generator – LPagery\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.1.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-110019（Bulk Page Generator – LPagery）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのはバージョン 3.1.0 までのすべての Bulk Page Generator – LPagery のバージョンです。\n・攻撃者はサブスクライバー以上の認証済みユーザーである必要があります。\n・デフォルトの新規インストールで Freemius が有効化されていない場合、Bearer トークンが任意の認証済みユーザーにより偽造可能です。\n・公式の対象表：niklaslindemann / Bulk Page Generator – LPagery。影響ありとして記載：3.1.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-110019", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:56.165Z", "lastSuccess": "2026-10-23T03:20:56.165Z", "sourceCheckedAt": "2026-10-23T02:43:44.113Z", "errorCode": null }, "glossary": [] } } ], "total": 2185, "limit": 20, "offset": 280, "filters": { "product": "all", "type": "all", "q": "", "page": 15 }, "pagination": { "page": 15, "pageSize": 20, "totalPages": 110 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 20, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T06:02:49.165Z 〜 2026-10-23T07:17:49.537Z、全製品の変更 31/31件まで確認、対象20件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }