{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-109998", "aliases": [], "title": "Mang Board：ブラウザー上での不正な処理", "summary": "Mang Board 2.4.3 以下のバージョンにおいて、認証されていない攻撃者が 'content' パラメータを介した保存型クロスサイトスクリプティング（XSS）を実行できる。", "risk": "攻撃者が任意のウェブスクリプトをページに埋め込めるため、ページを閲覧したユーザーのブラウザでそのスクリプトが実行される可能性がある。", "product": "Mang Board", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Mang Board", "range": "<= 2.4.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109998", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe455dc-8138-49d0-97a1-b0dce111d23b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L150", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L177", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php#L24", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L146", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3738899%40mangboard&new=3738899%40mangboard", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109998", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:02.743Z", "modifiedAt": "2026-10-16T15:17:08.570Z", "fetchedAt": "2026-10-23T02:43:43.896Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.", "sourceTitle": "Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "kitae-park", "product": "Mang Board", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "2.4.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109998", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "fetchedAt": "2026-10-23T02:43:43.896Z", "publishedAt": "2026-10-16T04:27:02.743Z", "modifiedAt": "2026-10-16T14:39:05.628Z", "state": "published", "provider": "Wordfence", "title": "Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX", "descriptions": [ { "lang": "en", "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "kitae-park", "product": "Mang Board", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.4.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe455dc-8138-49d0-97a1-b0dce111d23b?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L150", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L177", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php#L24", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L146", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3738899%40mangboard&new=3738899%40mangboard", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"kitae-park\",\"product\":\"Mang Board\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:05.628Z", "fetchedAt": "2026-10-23T02:43:43.896Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:08.570Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Mang Boardにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:56.454Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b53e81e3267c986d7e59c1fedd61d9bd01904471eb5b59fade56bbec3385f506", "sourceModifiedAt": "2026-10-16T15:17:08.570Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Mang Board 2.4.3 以下のバージョンにおいて、認証されていない攻撃者が 'content' パラメータを介した保存型クロスサイトスクリプティング（XSS）を実行できる。", "risk": "攻撃者が任意のウェブスクリプトをページに埋め込めるため、ページを閲覧したユーザーのブラウザでそのスクリプトが実行される可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象製品は WordPress 用 Mang Board プラグインである。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "バージョン 2.4.3 まで（2.4.3 を含む）すべてのバージョンが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "攻撃は認証されていない攻撃者により実行可能である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "wp_ajax_nopriv_mb_template エンドポイントが認証なしで公開されている。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "content_reply モードでは nonce 検証が行われていない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "admin-ajax.php のレスポンスヘッダーが Content-Type: text/html となっており、JSON 応答本文に埋め込まれたタグがブラウザで実行される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：kitae-park / Mang Board。影響ありとして記載：2.4.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Mang Board」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109998", "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe455dc-8138-49d0-97a1-b0dce111d23b?source=cve", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L150", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L177", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php#L24", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L146", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3738899%40mangboard&new=3738899%40mangboard", "https://nvd.nist.gov/vuln/detail/CVE-2026-109998" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109998", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe455dc-8138-49d0-97a1-b0dce111d23b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L150", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-template.php#L177", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/api/mb-board.php#L24", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.api.php#L146", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3738899%40mangboard&new=3738899%40mangboard", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109998", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "sourceField": "/containers/cna/title", "excerpt": "Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the wp_ajax_nopriv_mb_template endpoint is publicly accessible without authentication, nonce verification is not enforced for the content_reply mode, and admin-ajax.php responds with Content-Type: text/html, causing browsers to execute injected tags embedded in the JSON response body.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109998.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"kitae-park\",\"product\":\"Mang Board\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109998（Mang Board）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は WordPress 用 Mang Board プラグインである。\n・バージョン 2.4.3 まで（2.4.3 を含む）すべてのバージョンが影響を受ける。\n・攻撃は認証されていない攻撃者により実行可能である。\n・wp_ajax_nopriv_mb_template エンドポイントが認証なしで公開されている。\n・content_reply モードでは nonce 検証が行われていない。\n・admin-ajax.php のレスポンスヘッダーが Content-Type: text/html となっており、JSON 応答本文に埋め込まれたタグがブラウザで実行される。\n・公式の対象表：kitae-park / Mang Board。影響ありとして記載：2.4.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109998", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:56.454Z", "lastSuccess": "2026-10-23T03:20:56.454Z", "sourceCheckedAt": "2026-10-23T02:43:43.896Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" }, { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109515", "aliases": [], "title": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.：権限の奪取", "summary": "MailOptin プラグイン（バージョン 1.2.78.6 まで）は、`subscribe_to_email_list` エンドポイントが攻撃者提供の `optin_data[form_custom_field_mappings]` パラメータを許可リストなしで受け入れるため、管理者が保存したマッピングを上書きでき、任意の `wp_users` カラム名（例: `ID` や `user_pass`）を `wp_insert_user()` に渡すことが可能になります。これにより、認証されていない攻撃者でも対象ユーザーの数値 ID を指定して `wp_insert_user()` を UPDATE モードで実行させ、任意のハッシュ化済みパスワードでそのアカウントのパスワードを書き換え、管理者を含む任意の WordPress ユーザーアカウントを乗っ取ることができ、サイト全体が侵害されます。攻撃には、サイト内に WordPress ユーザー登録用オプトインフォームが公開されていることが必要で、フォームの UUID はページソースに表示され、エンドポイントへのアクセスに認証、nonce、権限チェックは一切行われません。", "risk": "攻撃者が任意の WordPress ユーザー（管理者を含む）のパスワードを書き換えることで、サイト全体が完全に乗っ取られる危険があります。", "product": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.", "category": "wordpress", "component": "plugin", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.", "range": "<= 1.2.78.6" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109515", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96111116-6b6f-42fc-98d8-6f5c27dc3c1c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/connections/WordPressUserRegistrationConnect/Subscription.php#L68", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/Connections/AbstractConnect.php#L84", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/AjaxHandler.php#L699", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3744644%40mailoptin%2Ftrunk&old=3738326%40mailoptin%2Ftrunk#file4", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3744644/mailoptin/trunk/src/connections/WordPressUserRegistrationConnect/Subscription.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109515", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:01.480Z", "modifiedAt": "2026-10-16T15:17:07.900Z", "fetchedAt": "2026-10-23T02:43:43.495Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.", "sourceTitle": "MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "properfraction", "product": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.2.78.6", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109515", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "fetchedAt": "2026-10-23T02:43:43.495Z", "publishedAt": "2026-10-16T04:27:01.480Z", "modifiedAt": "2026-10-16T15:09:39.848Z", "state": "published", "provider": "Wordfence", "title": "MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter", "descriptions": [ { "lang": "en", "value": "The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "properfraction", "product": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.2.78.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96111116-6b6f-42fc-98d8-6f5c27dc3c1c?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/connections/WordPressUserRegistrationConnect/Subscription.php#L68", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/Connections/AbstractConnect.php#L84", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/AjaxHandler.php#L699", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3744644%40mailoptin%2Ftrunk&old=3738326%40mailoptin%2Ftrunk#file4", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3744644/mailoptin/trunk/src/connections/WordPressUserRegistrationConnect/Subscription.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"properfraction\",\"product\":\"MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.2.78.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:39.848Z", "fetchedAt": "2026-10-23T02:43:43.495Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.900Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.に権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:57.357Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "06884764397a94afe2ec96e02fdf19e9262d35909b43b87091e393d89b2d0856", "sourceModifiedAt": "2026-10-16T15:17:07.900Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "MailOptin プラグイン（バージョン 1.2.78.6 まで）は、`subscribe_to_email_list` エンドポイントが攻撃者提供の `optin_data[form_custom_field_mappings]` パラメータを許可リストなしで受け入れるため、管理者が保存したマッピングを上書きでき、任意の `wp_users` カラム名（例: `ID` や `user_pass`）を `wp_insert_user()` に渡すことが可能になります。これにより、認証されていない攻撃者でも対象ユーザーの数値 ID を指定して `wp_insert_user()` を UPDATE モードで実行させ、任意のハッシュ化済みパスワードでそのアカウントのパスワードを書き換え、管理者を含む任意の WordPress ユーザーアカウントを乗っ取ることができ、サイト全体が侵害されます。攻撃には、サイト内に WordPress ユーザー登録用オプトインフォームが公開されていることが必要で、フォームの UUID はページソースに表示され、エンドポイントへのアクセスに認証、nonce、権限チェックは一切行われません。", "risk": "攻撃者が任意の WordPress ユーザー（管理者を含む）のパスワードを書き換えることで、サイト全体が完全に乗っ取られる危険があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "MailOptin プラグインのバージョンが 1.2.78.6 以下（含む）である場合に影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "サイト内に WordPress ユーザー登録用オプトインフォームが公開されていることが攻撃成立の前提条件です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "`subscribe_to_email_list` エンドポイントへのリクエストは認証、nonce、権限チェックが行われないため、誰でも利用可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：properfraction / MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.。影響ありとして記載：1.2.78.6以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109515", "https://www.wordfence.com/threat-intel/vulnerabilities/id/96111116-6b6f-42fc-98d8-6f5c27dc3c1c?source=cve", "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/connections/WordPressUserRegistrationConnect/Subscription.php#L68", "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/Connections/AbstractConnect.php#L84", "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/AjaxHandler.php#L699", "https://plugins.trac.wordpress.org/changeset?reponame=&new=3744644%40mailoptin%2Ftrunk&old=3738326%40mailoptin%2Ftrunk#file4", "https://plugins.trac.wordpress.org/changeset/3744644/mailoptin/trunk/src/connections/WordPressUserRegistrationConnect/Subscription.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-109515" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109515", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/96111116-6b6f-42fc-98d8-6f5c27dc3c1c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/connections/WordPressUserRegistrationConnect/Subscription.php#L68", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/Connections/AbstractConnect.php#L84", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/AjaxHandler.php#L699", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3744644%40mailoptin%2Ftrunk&old=3738326%40mailoptin%2Ftrunk#file4", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3744644/mailoptin/trunk/src/connections/WordPressUserRegistrationConnect/Subscription.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109515", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "sourceField": "/containers/cna/title", "excerpt": "MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109515.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"properfraction\",\"product\":\"MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.2.78.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109515（MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・MailOptin プラグインのバージョンが 1.2.78.6 以下（含む）である場合に影響を受けます。\n・サイト内に WordPress ユーザー登録用オプトインフォームが公開されていることが攻撃成立の前提条件です。\n・`subscribe_to_email_list` エンドポイントへのリクエストは認証、nonce、権限チェックが行われないため、誰でも利用可能です。\n・公式の対象表：properfraction / MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.。影響ありとして記載：1.2.78.6以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109515", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:57.357Z", "lastSuccess": "2026-10-23T03:20:57.357Z", "sourceCheckedAt": "2026-10-23T02:43:43.495Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109512", "aliases": [], "title": "Mang Board：ブラウザー上での不正な処理", "summary": "Mang Board のバージョン 2.4.4 以下において、サブスクライバー以上の認証ユーザーが 'content' パラメータを通じて保存型クロスサイトスクリプティング（XSS）を実行できる脆弱性があります。", "risk": "攻撃者が注入したスクリプトが、ページを閲覧したユーザーのブラウザーで実行されます。", "product": "Mang Board", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Mang Board", "range": "<= 2.4.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109512", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b1e2f1-a287-4b9b-94bb-b860bc4748c3?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-filters.php#L75", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-template.php#L503", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L85", "label": "security@wordfence.com" }, { "url": "https://wordpress.org/plugins/mangboard/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/skin-filters.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109512", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:26:59.633Z", "modifiedAt": "2026-10-16T15:17:07.690Z", "fetchedAt": "2026-10-23T02:43:43.461Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.", "sourceTitle": "Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "kitae-park", "product": "Mang Board", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "2.4.4", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109512", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "fetchedAt": "2026-10-23T02:43:43.461Z", "publishedAt": "2026-10-16T04:26:59.633Z", "modifiedAt": "2026-10-16T14:39:06.105Z", "state": "published", "provider": "Wordfence", "title": "Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter", "descriptions": [ { "lang": "en", "value": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "kitae-park", "product": "Mang Board", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.4.4", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b1e2f1-a287-4b9b-94bb-b860bc4748c3?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-filters.php#L75", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-template.php#L503", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L85", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://wordpress.org/plugins/mangboard/", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/skin-filters.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"kitae-park\",\"product\":\"Mang Board\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:06.105Z", "fetchedAt": "2026-10-23T02:43:43.461Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:07.690Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Mang Boardにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:58.420Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4ee8635424307ef96711aabe36cec6396158beea43bcb82242114e96a43c4e5d", "sourceModifiedAt": "2026-10-16T15:17:07.690Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Mang Board のバージョン 2.4.4 以下において、サブスクライバー以上の認証ユーザーが 'content' パラメータを通じて保存型クロスサイトスクリプティング（XSS）を実行できる脆弱性があります。", "risk": "攻撃者が注入したスクリプトが、ページを閲覧したユーザーのブラウザーで実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Mang Board のバージョン 2.4.4 以下すべてが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "認証済みの攻撃者で、サブスクライバー以上の権限が必要です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "'content' パラメータに対する入力サニタイズと出力エスケープが不十分です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "modify リクエストで data_type パラメータを省略でき、HTMLPurifier の処理が完全にスキップされ、mbw_htmlspecialchars2 エンコードのみが残ります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：kitae-park / Mang Board。影響ありとして記載：2.4.4以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Mang Board」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109512", "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b1e2f1-a287-4b9b-94bb-b860bc4748c3?source=cve", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-filters.php#L75", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-template.php#L503", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L85", "https://wordpress.org/plugins/mangboard/", "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/skin-filters.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-109512" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109512", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71b1e2f1-a287-4b9b-94bb-b860bc4748c3?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-filters.php#L75", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/skin-template.php#L503", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L85", "label": "security@wordfence.com" }, { "url": "https://wordpress.org/plugins/mangboard/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/skin-filters.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109512", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "sourceField": "/containers/cna/title", "excerpt": "Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitization bypass is further compounded by the ability to omit the data_type parameter in a modify request, which skips the HTMLPurifier branch entirely and leaves only mbw_htmlspecialchars2 encoding — fully reversed at render — as the sole barrier.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109512.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"kitae-park\",\"product\":\"Mang Board\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109512（Mang Board）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Mang Board のバージョン 2.4.4 以下すべてが影響を受けます。\n・認証済みの攻撃者で、サブスクライバー以上の権限が必要です。\n・'content' パラメータに対する入力サニタイズと出力エスケープが不十分です。\n・modify リクエストで data_type パラメータを省略でき、HTMLPurifier の処理が完全にスキップされ、mbw_htmlspecialchars2 エンコードのみが残ります。\n・公式の対象表：kitae-park / Mang Board。影響ありとして記載：2.4.4以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109512", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:58.420Z", "lastSuccess": "2026-10-23T03:20:58.420Z", "sourceCheckedAt": "2026-10-23T02:43:43.461Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109400", "aliases": [], "title": "InstaWP Connect – 1-click WP Staging & Migration：権限の奪取", "summary": "InstaWP Connect – 1-click WP Staging & Migration プラグインは、バージョン 0.1.4.1 までのすべてのバージョンで、認証済みの Subscriber 以上のユーザーが特権をエスカレートできる脆弱性があります。プラグインは管理ページを `add_management_page()` で登録する際に、`InstaWP_Setting::get_allowed_role()` が返すロール名を必要な権限として使用しますが、WordPress はそのロールを保持しているユーザーを実際の権限として扱います。さらに、`generate_section_field()` が `instawp_api_options` から取得したマスター API キーをプレーンテキストの HTML 入力の `value` 属性にそのまま出力し、追加の `manage_options` などの権限チェックを行いません。そのため、Subscriber 権限以上の認証ユーザーはマスター API キーを取得し、SHA‑256 から導出したシークレットをプラグインの REST API `validate_api_request()` が受け入れるベアラートークンとして使用できます。続いて `POST /wp-json/instawp-connect/v2/auto-login` を呼び出すと、30 秒間有効な単一使用のログイン URL が生成され、管理者用の認証クッキーが設定され、結果として管理者権限が取得されます。攻撃が成立するには、サイトが InstaWP と接続されており、管理者が攻撃者のロールをプラグインの Sync Tab Access リスト（`instawp_sync_tab_roles`）に追加している必要があります。設定タブの非表示ロジックは、リストに `administrator` が全く含まれていない場合にのみタブを隠すため、管理者と低権限ロールが混在してリストに残っていると、低権限ユーザーにも設定ページ全体（API キーを含む）が表示されます。", "risk": "攻撃者は管理者権限の認証クッキーを取得できるため、サイト全体を自由に操作できるようになります。", "product": "InstaWP Connect – 1-click WP Staging & Migration", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "InstaWP Connect – 1-click WP Staging & Migration", "range": "<= 0.1.4.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109400", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109400", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:01.115Z", "modifiedAt": "2026-10-16T16:17:03.387Z", "fetchedAt": "2026-10-23T02:43:43.374Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.", "sourceTitle": "InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "instawp", "product": "InstaWP Connect – 1-click WP Staging & Migration", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "0.1.4.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109400", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "fetchedAt": "2026-10-23T02:43:43.374Z", "publishedAt": "2026-10-16T04:27:01.115Z", "modifiedAt": "2026-10-16T15:46:59.318Z", "state": "published", "provider": "Wordfence", "title": "InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting", "descriptions": [ { "lang": "en", "value": "The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "instawp", "product": "InstaWP Connect – 1-click WP Staging & Migration", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "0.1.4.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"instawp\",\"product\":\"InstaWP Connect – 1-click WP Staging & Migration\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"0.1.4.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:46:59.318Z", "fetchedAt": "2026-10-23T02:43:43.374Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:17:03.387Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "InstaWP Connect – 1-click WP Staging & Migrationに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:58.465Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7485162b870f75822fd83955b0a6979ba3027872ecf0beb09eaee68ea153ec07", "sourceModifiedAt": "2026-10-16T16:17:03.387Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "InstaWP Connect – 1-click WP Staging & Migration プラグインは、バージョン 0.1.4.1 までのすべてのバージョンで、認証済みの Subscriber 以上のユーザーが特権をエスカレートできる脆弱性があります。プラグインは管理ページを `add_management_page()` で登録する際に、`InstaWP_Setting::get_allowed_role()` が返すロール名を必要な権限として使用しますが、WordPress はそのロールを保持しているユーザーを実際の権限として扱います。さらに、`generate_section_field()` が `instawp_api_options` から取得したマスター API キーをプレーンテキストの HTML 入力の `value` 属性にそのまま出力し、追加の `manage_options` などの権限チェックを行いません。そのため、Subscriber 権限以上の認証ユーザーはマスター API キーを取得し、SHA‑256 から導出したシークレットをプラグインの REST API `validate_api_request()` が受け入れるベアラートークンとして使用できます。続いて `POST /wp-json/instawp-connect/v2/auto-login` を呼び出すと、30 秒間有効な単一使用のログイン URL が生成され、管理者用の認証クッキーが設定され、結果として管理者権限が取得されます。攻撃が成立するには、サイトが InstaWP と接続されており、管理者が攻撃者のロールをプラグインの Sync Tab Access リスト（`instawp_sync_tab_roles`）に追加している必要があります。設定タブの非表示ロジックは、リストに `administrator` が全く含まれていない場合にのみタブを隠すため、管理者と低権限ロールが混在してリストに残っていると、低権限ユーザーにも設定ページ全体（API キーを含む）が表示されます。", "risk": "攻撃者は管理者権限の認証クッキーを取得できるため、サイト全体を自由に操作できるようになります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるバージョンは 0.1.4.1 までのすべてのバージョンです（0 を含む上限は 0.1.4.1）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃には、Subscriber 権限以上の認証済みユーザーが必要です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象サイトが InstaWP と接続されていることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "管理者が攻撃者のロールを `instawp_sync_tab_roles` に追加している必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "`administrator` ロールがリストから完全に除外されていない限り、低権限ユーザーにも設定タブが表示されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：instawp / InstaWP Connect – 1-click WP Staging & Migration。影響ありとして記載：0.1.4.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「InstaWP Connect – 1-click WP Staging & Migration」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109400", "https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cve", "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186", "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153", "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91", "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663", "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194", "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041", "https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-109400" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109400", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L186", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/admin/class-instawp-admin.php#L153", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-setting.php#L91", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/apis/class-instawp-rest-api.php#L663", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/class-instawp-hooks.php#L194", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.4.1/includes/functions.php#L1041", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743786/instawp-connect/trunk/includes/class-instawp-setting.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109400", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (`instawp_sync_tab_roles`); notably, the settings tab suppression logic only hides the tab when `administrator` is absent from the list entirely, meaning a mixed configuration retaining administrator alongside a lower role still serves the full settings page — including the API key — to the lower-privileged user.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "sourceField": "/containers/cna/title", "excerpt": "InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109400.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"instawp\",\"product\":\"InstaWP Connect – 1-click WP Staging & Migration\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"0.1.4.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109400（InstaWP Connect – 1-click WP Staging & Migration）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるバージョンは 0.1.4.1 までのすべてのバージョンです（0 を含む上限は 0.1.4.1）。\n・攻撃には、Subscriber 権限以上の認証済みユーザーが必要です。\n・対象サイトが InstaWP と接続されていることが前提です。\n・管理者が攻撃者のロールを `instawp_sync_tab_roles` に追加している必要があります。\n・`administrator` ロールがリストから完全に除外されていない限り、低権限ユーザーにも設定タブが表示されます。\n・公式の対象表：instawp / InstaWP Connect – 1-click WP Staging & Migration。影響ありとして記載：0.1.4.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109400", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:58.465Z", "lastSuccess": "2026-10-23T03:20:58.465Z", "sourceCheckedAt": "2026-10-23T02:43:43.374Z", "errorCode": null }, "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109221", "aliases": [], "title": "Groundhogg — CRM, Newsletters, and Marketing Automation：コード実行", "summary": "Groundhogg プラグイン（バージョン 4.9.3 以下）では、Sales Representative 以上の権限を持つ認証済みユーザーが CSV インポート時の 'copy_file' フィールドマッピングを利用して任意のファイルを削除できる。", "risk": "任意のファイルが削除され、たとえば wp-config.php を削除するとサーバー上で攻撃者のコードが実行される可能性がある。", "product": "Groundhogg — CRM, Newsletters, and Marketing Automation", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "affected": [ { "product": "Groundhogg — CRM, Newsletters, and Marketing Automation", "range": "<= 4.9.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109221", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L94", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L85", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/utils/files.php#L323", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L2872", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L8045", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/background/import-contacts.php#L200", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L575", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L602", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/main-roles.php#L583", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109221", "label": "NVDの原文" }, { "url": "https://github.com/groundhoggwp/groundhogg/commit/e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3744461/groundhogg/trunk/includes/classes/traits/file-box.php", "label": "security@wordfence.com" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:05.579Z", "modifiedAt": "2026-10-16T18:17:30.680Z", "fetchedAt": "2026-10-23T02:43:43.188Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.", "sourceTitle": "Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "trainingbusinesspros", "product": "Groundhogg — CRM, Newsletters, and Marketing Automation", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "4.9.3", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109221", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "fetchedAt": "2026-10-23T02:43:43.188Z", "publishedAt": "2026-10-16T04:27:05.579Z", "modifiedAt": "2026-10-16T17:07:01.282Z", "state": "published", "provider": "Wordfence", "title": "Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping", "descriptions": [ { "lang": "en", "value": "The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "trainingbusinesspros", "product": "Groundhogg — CRM, Newsletters, and Marketing Automation", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "4.9.3", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L94", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L85", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/utils/files.php#L323", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L2872", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L8045", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/background/import-contacts.php#L200", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L575", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L602", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/8" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/main-roles.php#L583", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/9" }, { "url": "https://github.com/groundhoggwp/groundhogg/commit/e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/10" }, { "url": "https://plugins.trac.wordpress.org/changeset/3744461/groundhogg/trunk/includes/classes/traits/file-box.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/11" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"trainingbusinesspros\",\"product\":\"Groundhogg — CRM, Newsletters, and Marketing Automation\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.9.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"cweId\":\"CWE-22\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T17:07:01.282Z", "fetchedAt": "2026-10-23T02:43:43.188Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T18:17:30.680Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Groundhogg — CRM, Newsletters, and Marketing Automationにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:20:58.537Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2aed8b2d911f0be32388a6d1460e18d6e19b64fd829fb9450c2501290ff17881", "sourceModifiedAt": "2026-10-16T18:17:30.680Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Groundhogg プラグイン（バージョン 4.9.3 以下）では、Sales Representative 以上の権限を持つ認証済みユーザーが CSV インポート時の 'copy_file' フィールドマッピングを利用して任意のファイルを削除できる。", "risk": "任意のファイルが削除され、たとえば wp-config.php を削除するとサーバー上で攻撃者のコードが実行される可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "バージョン 4.9.3 以下のすべてのリリースが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "認証済みで Sales Representative 以上の権限を持つユーザーが攻撃可能である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "plugin が定義する import_contacts 権限を保持しているユーザーが利用でき、デフォルトでカスタム Sales Representative ロールに付与されている。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：trainingbusinesspros / Groundhogg — CRM, Newsletters, and Marketing Automation。影響ありとして記載：4.9.3以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Groundhogg — CRM, Newsletters, and Marketing Automation」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109221", "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=cve", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L94", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L85", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/utils/files.php#L323", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L2872", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L8045", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/background/import-contacts.php#L200", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L575", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L602", "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/main-roles.php#L583", "https://nvd.nist.gov/vuln/detail/CVE-2026-109221", "https://github.com/groundhoggwp/groundhogg/commit/e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0", "https://plugins.trac.wordpress.org/changeset/3744461/groundhogg/trunk/includes/classes/traits/file-box.php" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109221", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L94", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/classes/traits/file-box.php#L85", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/utils/files.php#L323", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L2872", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/functions.php#L8045", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/background/import-contacts.php#L200", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L575", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/admin/tools/tools-page.php#L602", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/groundhogg/tags/4.9.3/includes/main-roles.php#L583", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109221", "label": "NVDの原文" }, { "url": "https://github.com/groundhoggwp/groundhogg/commit/e319e4a849bfbb07cccfbac8558ad6bf07a7fdc0", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3744461/groundhogg/trunk/includes/classes/traits/file-box.php", "label": "security@wordfence.com" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "sourceField": "/containers/cna/title", "excerpt": "Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by any user holding the plugin-defined import_contacts capability, which is granted by default to the plugin's custom Sales Representative role.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109221.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"trainingbusinesspros\",\"product\":\"Groundhogg — CRM, Newsletters, and Marketing Automation\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"4.9.3\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109221（Groundhogg — CRM, Newsletters, and Marketing Automation）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 4.9.3 以下のすべてのリリースが影響を受ける。\n・認証済みで Sales Representative 以上の権限を持つユーザーが攻撃可能である。\n・plugin が定義する import_contacts 権限を保持しているユーザーが利用でき、デフォルトでカスタム Sales Representative ロールに付与されている。\n・公式の対象表：trainingbusinesspros / Groundhogg — CRM, Newsletters, and Marketing Automation。影響ありとして記載：4.9.3以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109221", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:20:58.537Z", "lastSuccess": "2026-10-23T03:20:58.537Z", "sourceCheckedAt": "2026-10-23T02:43:43.188Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-109219", "aliases": [], "title": "Mang Board：コード実行", "summary": "Mang Boardプラグイン（バージョン2.4.4以下）は、image_path パラメータに対する拡張子検証が欠如しているため、認証されていない攻撃者が任意のファイルをアップロードできる脆弱性があります。mbw_file_upload 関数で処理され、file_name パラメータの拡張子許可リストは basename から導出されたファイル名には適用されません。この欠陥により、実行可能なファイルをアップロードでき、リモートコード実行が可能になります。攻撃には、プラグインのデフォルト設定であるゲスト投稿許可が必要で、nonce がすべての公開ボードページに表示されるため、WordPress にログインしていない訪問者でも取得できます。", "risk": "実行可能なファイルをアップロードできるため、リモートコード実行が可能になる恐れがあります。", "product": "Mang Board", "category": "wordpress", "component": "plugin", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Mang Board", "range": "<= 2.4.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109219", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520", "label": "security@wordfence.com" }, { "url": "https://wordpress.org/plugins/mangboard/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109219", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:26:58.632Z", "modifiedAt": "2026-10-16T15:17:06.810Z", "fetchedAt": "2026-10-23T02:43:43.121Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.", "sourceTitle": "Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "kitae-park", "product": "Mang Board", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "2.4.4", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109219", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "fetchedAt": "2026-10-23T02:43:43.121Z", "publishedAt": "2026-10-16T04:26:58.632Z", "modifiedAt": "2026-10-16T15:09:40.600Z", "state": "published", "provider": "Wordfence", "title": "Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter", "descriptions": [ { "lang": "en", "value": "The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "kitae-park", "product": "Mang Board", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.4.4", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://wordpress.org/plugins/mangboard/", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"kitae-park\",\"product\":\"Mang Board\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-434 Unrestricted Upload of File with Dangerous Type\",\"cweId\":\"CWE-434\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:40.600Z", "fetchedAt": "2026-10-23T02:43:43.121Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:06.810Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Mang Boardにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:00.522Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f9945acc6c1cfa44b9762510ba693d3a8ba9bfa8a1cd7e6117dbd542c116c3c7", "sourceModifiedAt": "2026-10-16T15:17:06.810Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Mang Boardプラグイン（バージョン2.4.4以下）は、image_path パラメータに対する拡張子検証が欠如しているため、認証されていない攻撃者が任意のファイルをアップロードできる脆弱性があります。mbw_file_upload 関数で処理され、file_name パラメータの拡張子許可リストは basename から導出されたファイル名には適用されません。この欠陥により、実行可能なファイルをアップロードでき、リモートコード実行が可能になります。攻撃には、プラグインのデフォルト設定であるゲスト投稿許可が必要で、nonce がすべての公開ボードページに表示されるため、WordPress にログインしていない訪問者でも取得できます。", "risk": "実行可能なファイルをアップロードできるため、リモートコード実行が可能になる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "バージョン2.4.4以下のMang Boardプラグインが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "認証されていない攻撃者がこの脆弱性を利用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "ボードがゲスト投稿を許可する設定（デフォルト設定）であることが必要です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "必要なnonceが公開ボードページに表示され、WordPressにログインしていない訪問者でも取得可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：kitae-park / Mang Board。影響ありとして記載：2.4.4以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Mang Board」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109219", "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428", "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520", "https://wordpress.org/plugins/mangboard/", "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-109219" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109219", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520", "label": "security@wordfence.com" }, { "url": "https://wordpress.org/plugins/mangboard/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109219", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "sourceField": "/containers/cna/title", "excerpt": "Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109219.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"kitae-park\",\"product\":\"Mang Board\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"2.4.4\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109219（Mang Board）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン2.4.4以下のMang Boardプラグインが影響を受けます。\n・認証されていない攻撃者がこの脆弱性を利用できます。\n・ボードがゲスト投稿を許可する設定（デフォルト設定）であることが必要です。\n・必要なnonceが公開ボードページに表示され、WordPressにログインしていない訪問者でも取得可能です。\n・公式の対象表：kitae-park / Mang Board。影響ありとして記載：2.4.4以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109219", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:00.522Z", "lastSuccess": "2026-10-23T03:21:00.522Z", "sourceCheckedAt": "2026-10-23T02:43:43.121Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" }, { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-109191", "aliases": [], "title": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy：情報の漏えい", "summary": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy プラグイン（WordPress 用）は、バージョン 1.2.0 までのすべてのバージョンで、'image_hub_api_keys_*'（6 つのオプション）パラメータを通じて機密情報が漏洩する脆弱性があります。認証済みの攻撃者（Subscriber 以上の権限）がこのパラメータを利用すると、Giphy、Openverse（クライアント ID とシークレット）、Pexels、Pixabay、Unsplash の API 資格情報が管理画面の HTML に平文で出力されます。さらに、漏洩した HTML には有効な image_hub_nonce AJAX nonce が含まれ、image_hub_update_settings AJAX ハンドラに権限チェックがないため、同じ権限の攻撃者が update_option() を使ってこれら 6 つの API 資格情報を上書きできます。", "risk": "認証済みの攻撃者が管理画面の HTML からサードパーティサービスの API 資格情報を取得でき、さらにその資格情報を任意に書き換えることができるため、情報漏洩と設定改ざんのリスクがあります。", "product": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy", "range": "<= 1.2.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109191", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99d1e0cc-1fd0-47f7-8b73-33663ed72eea?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L38", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L19", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L78", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/image-hub.php#L46", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L23", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L56", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Utils.php#L11", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3745452/image-hub/trunk/inc/src/MediaModal.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109191", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:01.828Z", "modifiedAt": "2026-10-16T15:17:06.477Z", "fetchedAt": "2026-10-23T02:43:43.042Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().", "sourceTitle": "Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "extendthemes", "product": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.2.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-109191", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "fetchedAt": "2026-10-23T02:43:43.042Z", "publishedAt": "2026-10-16T04:27:01.828Z", "modifiedAt": "2026-10-16T15:09:39.704Z", "state": "published", "provider": "Wordfence", "title": "Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML", "descriptions": [ { "lang": "en", "value": "The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "extendthemes", "product": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.2.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99d1e0cc-1fd0-47f7-8b73-33663ed72eea?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L38", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L19", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L78", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/image-hub.php#L46", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L23", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L56", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Utils.php#L11", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" }, { "url": "https://plugins.trac.wordpress.org/changeset/3745452/image-hub/trunk/inc/src/MediaModal.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/8" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"extendthemes\",\"product\":\"Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.2.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\",\"cweId\":\"CWE-200\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:39.704Z", "fetchedAt": "2026-10-23T02:43:43.042Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:06.477Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ], "sourceSummary": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphyに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:01.042Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "1a351e911b4c62305815890b10706fe1426cf9c934325bc3420179b220807552", "sourceModifiedAt": "2026-10-16T15:17:06.477Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy プラグイン（WordPress 用）は、バージョン 1.2.0 までのすべてのバージョンで、'image_hub_api_keys_*'（6 つのオプション）パラメータを通じて機密情報が漏洩する脆弱性があります。認証済みの攻撃者（Subscriber 以上の権限）がこのパラメータを利用すると、Giphy、Openverse（クライアント ID とシークレット）、Pexels、Pixabay、Unsplash の API 資格情報が管理画面の HTML に平文で出力されます。さらに、漏洩した HTML には有効な image_hub_nonce AJAX nonce が含まれ、image_hub_update_settings AJAX ハンドラに権限チェックがないため、同じ権限の攻撃者が update_option() を使ってこれら 6 つの API 資格情報を上書きできます。", "risk": "認証済みの攻撃者が管理画面の HTML からサードパーティサービスの API 資格情報を取得でき、さらにその資格情報を任意に書き換えることができるため、情報漏洩と設定改ざんのリスクがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Image Hub プラグインのバージョンが 1.2.0 以下（1.2.0 を含む）であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者が認証済みで、Subscriber レベル以上の権限を持っていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性が影響するパラメータは 'image_hub_api_keys_*' の 6 つのオプションであること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "管理画面の HTML に、Giphy、Openverse（クライアント ID とシークレット）、Pexels、Pixabay、Unsplash の API 資格情報が平文で出力されること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "この出力は wp_localize_script を通じて行われ、すべての管理ページで同様に含まれること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "漏洩した HTML には有効な image_hub_nonce AJAX nonce が含まれること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "image_hub_update_settings AJAX ハンドラに権限チェックが無いため、同じ Subscriber レベルの攻撃者が update_option() を用いて 6 つの API 資格情報設定を上書きできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：extendthemes / Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy。影響ありとして記載：1.2.0以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-109191", "https://www.wordfence.com/threat-intel/vulnerabilities/id/99d1e0cc-1fd0-47f7-8b73-33663ed72eea?source=cve", "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L38", "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L19", "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L78", "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/image-hub.php#L46", "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L23", "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L56", "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Utils.php#L11", "https://plugins.trac.wordpress.org/changeset/3745452/image-hub/trunk/inc/src/MediaModal.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-109191" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-109191", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99d1e0cc-1fd0-47f7-8b73-33663ed72eea?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L38", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L19", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L78", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/image-hub.php#L46", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Settings.php#L23", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/MediaModal.php#L56", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/image-hub/tags/1.2.0/inc/src/Utils.php#L11", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3745452/image-hub/trunk/inc/src/MediaModal.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109191", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wp_localize_script. The leaked page HTML also contains a valid image_hub_nonce AJAX nonce, which — combined with the absence of any capability check in the image_hub_update_settings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via update_option().", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "sourceField": "/containers/cna/title", "excerpt": "Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109191.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"extendthemes\",\"product\":\"Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.2.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-109191（Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Image Hub プラグインのバージョンが 1.2.0 以下（1.2.0 を含む）であること。\n・攻撃者が認証済みで、Subscriber レベル以上の権限を持っていること。\n・脆弱性が影響するパラメータは 'image_hub_api_keys_*' の 6 つのオプションであること。\n・管理画面の HTML に、Giphy、Openverse（クライアント ID とシークレット）、Pexels、Pixabay、Unsplash の API 資格情報が平文で出力されること。\n・この出力は wp_localize_script を通じて行われ、すべての管理ページで同様に含まれること。\n・漏洩した HTML には有効な image_hub_nonce AJAX nonce が含まれること。\n・image_hub_update_settings AJAX ハンドラに権限チェックが無いため、同じ Subscriber レベルの攻撃者が update_option() を用いて 6 つの API 資格情報設定を上書きできること。\n・公式の対象表：extendthemes / Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy。影響ありとして記載：1.2.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-109191", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:01.042Z", "lastSuccess": "2026-10-23T03:21:01.042Z", "sourceCheckedAt": "2026-10-23T02:43:43.042Z", "errorCode": null }, "glossary": [ { "term": "WordPressのnonce", "meaning": "画面や操作に対応する確認用の値です。意図しない操作を防ぐ助けになりますが、これだけで本人確認や操作権限の確認ができるわけではありません。", "sourceUrl": "https://developer.wordpress.org/apis/security/nonces/", "kind": "general_definition" } ] } }, { "id": "CVE-2026-107746", "aliases": [], "title": "FunnelKit – Funnel Builder Plugin for WooCommerce Checkout：情報の漏えい", "summary": "FunnelKit プラグイン（バージョン 3.16.0.6 以下）では、認証されていない攻撃者が 'order_id' または 'order' の POST パラメータを送信することで、認可チェックを回避できる欠陥があります。", "risk": "認証されていない攻撃者が順番に増える注文 ID を送信するだけで、WooCommerce の任意の注文に対する請求情報（氏名、住所、メールアドレス、電話番号）を取得できる可能性があります。", "product": "FunnelKit – Funnel Builder Plugin for WooCommerce Checkout", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "FunnelKit – Funnel Builder Plugin for WooCommerce Checkout", "range": "<= 3.16.0.6" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107746", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107746", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:03.447Z", "modifiedAt": "2026-10-16T16:16:57.983Z", "fetchedAt": "2026-10-23T02:43:42.630Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.", "sourceTitle": "FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "teamfunnelkit", "product": "FunnelKit – Funnel Builder Plugin for WooCommerce Checkout", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.16.0.6", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-107746", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "fetchedAt": "2026-10-23T02:43:42.630Z", "publishedAt": "2026-10-16T04:27:03.447Z", "modifiedAt": "2026-10-16T15:53:00.052Z", "state": "published", "provider": "Wordfence", "title": "FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter", "descriptions": [ { "lang": "en", "value": "The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "teamfunnelkit", "product": "FunnelKit – Funnel Builder Plugin for WooCommerce Checkout", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.16.0.6", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"teamfunnelkit\",\"product\":\"FunnelKit – Funnel Builder Plugin for WooCommerce Checkout\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.16.0.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-862 Missing Authorization\",\"cweId\":\"CWE-862\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:53:00.052Z", "fetchedAt": "2026-10-23T02:43:42.630Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:16:57.983Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "FunnelKit – Funnel Builder Plugin for WooCommerce Checkoutに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:01.204Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8f032878a7f10d854d168c13da02e1f46befc2054cf57f37defc072260a70b70", "sourceModifiedAt": "2026-10-16T16:16:57.983Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FunnelKit プラグイン（バージョン 3.16.0.6 以下）では、認証されていない攻撃者が 'order_id' または 'order' の POST パラメータを送信することで、認可チェックを回避できる欠陥があります。", "risk": "認証されていない攻撃者が順番に増える注文 ID を送信するだけで、WooCommerce の任意の注文に対する請求情報（氏名、住所、メールアドレス、電話番号）を取得できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "この欠陥は、バージョン 3.16.0.6 を含むそれ以前のすべての FunnelKit – Funnel Builder Plugin for WooCommerce Checkout に影響します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "なお、サイトに FunnelKit のサンキューページが存在し、[wfty_order_meta] または [wfty_order_total] ショートコードが表示されている場合にのみ悪用可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：teamfunnelkit / FunnelKit – Funnel Builder Plugin for WooCommerce Checkout。影響ありとして記載：3.16.0.6以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「FunnelKit – Funnel Builder Plugin for WooCommerce Checkout」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-107746", "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cve", "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318", "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328", "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286", "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429", "https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip", "https://nvd.nist.gov/vuln/detail/CVE-2026-107746" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107746", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429", "label": "security@wordfence.com" }, { "url": "https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107746", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "sourceField": "/containers/cna/title", "excerpt": "FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107746.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"teamfunnelkit\",\"product\":\"FunnelKit – Funnel Builder Plugin for WooCommerce Checkout\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.16.0.6\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-107746（FunnelKit – Funnel Builder Plugin for WooCommerce Checkout）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・この欠陥は、バージョン 3.16.0.6 を含むそれ以前のすべての FunnelKit – Funnel Builder Plugin for WooCommerce Checkout に影響します。\n・なお、サイトに FunnelKit のサンキューページが存在し、[wfty_order_meta] または [wfty_order_total] ショートコードが表示されている場合にのみ悪用可能です。\n・公式の対象表：teamfunnelkit / FunnelKit – Funnel Builder Plugin for WooCommerce Checkout。影響ありとして記載：3.16.0.6以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-107746", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:01.204Z", "lastSuccess": "2026-10-23T03:21:01.204Z", "sourceCheckedAt": "2026-10-23T02:43:42.630Z", "errorCode": null }, "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" } ] } }, { "id": "CVE-2026-107659", "aliases": [], "title": "Modula Image Gallery – Photo Grid & Video Gallery：情報の漏えい", "summary": "WordPress 用プラグイン「Modula Image Gallery – Photo Grid & Video Gallery」のバージョン 3.0.11 までにおいて、認証されていない攻撃者が modula-gallery カスタム投稿タイプの REST エンドポイント (/wp‑json/wp/v2/modula-gallery/{id}) から modulaSettings フィールドを取得でき、そこに含まれるパスワード保護用のパスワードとユーザー名が平文で漏洩します。プラグインが提供する /wp‑json/modula/v2/gallery/{id}/settings エンドポイントではパスワードがマスクされますが、上記のコアエンドポイントでは同様のマスクが行われていません。", "risk": "認証されていない攻撃者が、公開されているすべてのギャラリーのパスワード保護用パスワードとユーザー名を平文で取得できる可能性があります。", "product": "Modula Image Gallery – Photo Grid & Video Gallery", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "Modula Image Gallery – Photo Grid & Video Gallery", "range": "<= 3.0.11" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107659", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea70ffaf-b78b-4550-b334-d105f25b3f61?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L209", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L189", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L141", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3729079/modula-best-grid-gallery/trunk/includes/admin/cpt/class-modula-cpt.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107659", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:05.213Z", "modifiedAt": "2026-10-16T18:17:25.147Z", "fetchedAt": "2026-10-23T02:43:42.612Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.", "sourceTitle": "Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpchill", "product": "Modula Image Gallery – Photo Grid & Video Gallery", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.0.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-107659", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "fetchedAt": "2026-10-23T02:43:42.612Z", "publishedAt": "2026-10-16T04:27:05.213Z", "modifiedAt": "2026-10-16T17:07:09.932Z", "state": "published", "provider": "Wordfence", "title": "Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT", "descriptions": [ { "lang": "en", "value": "The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpchill", "product": "Modula Image Gallery – Photo Grid & Video Gallery", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.0.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea70ffaf-b78b-4550-b334-d105f25b3f61?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L209", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L189", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L141", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3729079/modula-best-grid-gallery/trunk/includes/admin/cpt/class-modula-cpt.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpchill\",\"product\":\"Modula Image Gallery – Photo Grid & Video Gallery\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.0.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-862 Missing Authorization\",\"cweId\":\"CWE-862\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T17:07:09.932Z", "fetchedAt": "2026-10-23T02:43:42.612Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T18:17:25.147Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Modula Image Gallery – Photo Grid & Video Galleryに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:02.601Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "238182ebeb8d0e7541e79c81b7732c875d7e8925a255cea353f9b9e0f6ecddd8", "sourceModifiedAt": "2026-10-16T18:17:25.147Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "WordPress 用プラグイン「Modula Image Gallery – Photo Grid & Video Gallery」のバージョン 3.0.11 までにおいて、認証されていない攻撃者が modula-gallery カスタム投稿タイプの REST エンドポイント (/wp‑json/wp/v2/modula-gallery/{id}) から modulaSettings フィールドを取得でき、そこに含まれるパスワード保護用のパスワードとユーザー名が平文で漏洩します。プラグインが提供する /wp‑json/modula/v2/gallery/{id}/settings エンドポイントではパスワードがマスクされますが、上記のコアエンドポイントでは同様のマスクが行われていません。", "risk": "認証されていない攻撃者が、公開されているすべてのギャラリーのパスワード保護用パスワードとユーザー名を平文で取得できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "WordPress 用プラグイン「Modula Image Gallery – Photo Grid & Video Gallery」のバージョン 3.0.11 までが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "REST API の /wp‑json/wp/v2/modula-gallery/{id}（またはコレクションルート）で、modulaSettings フィールドが認可チェックなしで公開されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：wpchill / Modula Image Gallery – Photo Grid & Video Gallery。影響ありとして記載：3.0.11以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Modula Image Gallery – Photo Grid & Video Gallery」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-107659", "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea70ffaf-b78b-4550-b334-d105f25b3f61?source=cve", "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L209", "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L189", "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L141", "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/", "https://plugins.trac.wordpress.org/changeset/3729079/modula-best-grid-gallery/trunk/includes/admin/cpt/class-modula-cpt.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-107659" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107659", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea70ffaf-b78b-4550-b334-d105f25b3f61?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L209", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L189", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L141", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3729079/modula-best-grid-gallery/trunk/includes/admin/cpt/class-modula-cpt.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107659", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "sourceField": "/containers/cna/title", "excerpt": "Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107659.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpchill\",\"product\":\"Modula Image Gallery – Photo Grid & Video Gallery\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.0.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-107659（Modula Image Gallery – Photo Grid & Video Gallery）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPress 用プラグイン「Modula Image Gallery – Photo Grid & Video Gallery」のバージョン 3.0.11 までが影響を受けます。\n・REST API の /wp‑json/wp/v2/modula-gallery/{id}（またはコレクションルート）で、modulaSettings フィールドが認可チェックなしで公開されます。\n・公式の対象表：wpchill / Modula Image Gallery – Photo Grid & Video Gallery。影響ありとして記載：3.0.11以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-107659", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:02.601Z", "lastSuccess": "2026-10-23T03:21:02.601Z", "sourceCheckedAt": "2026-10-23T02:43:42.612Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-104798", "aliases": [], "title": "My Calendar – Accessible Event Manager：権限の奪取", "summary": "My Calendar – Accessible Event Manager プラグインのバージョン 3.8.7 以下で、認証されていない攻撃者が `mcs` パラメータを利用し、`above` 属性へのショートコードインジェクションを反射させて特権昇格が可能になる。", "risk": "攻撃者は管理者アカウント（ユーザー ID 1）の認証情報を書き換え、wp‑admin へのフルアクセス権を取得できる。", "product": "My Calendar – Accessible Event Manager", "category": "wordpress", "component": "plugin", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "My Calendar – Accessible Event Manager", "range": "<= 3.4.24" }, { "product": "My Calendar – Accessible Event Manager", "range": ">= 3.5 / <= 3.5.21" }, { "product": "My Calendar – Accessible Event Manager", "range": ">= 3.6 / <= 3.6.17" }, { "product": "My Calendar – Accessible Event Manager", "range": ">= 3.7 / <= 3.7.17" }, { "product": "My Calendar – Accessible Event Manager", "range": ">= 3.8 / <= 3.8.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104798", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L221", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L170", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-shortcodes.php#L102", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-output.php#L1622", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3746389%40my-calendar&new=3746389%40my-calendar", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104798", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:04.876Z", "modifiedAt": "2026-10-16T18:17:20.360Z", "fetchedAt": "2026-10-23T02:43:41.761Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.", "sourceTitle": "My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "joedolson", "product": "My Calendar – Accessible Event Manager", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "3.4.24", "versionType": "semver" }, { "version": "3.5", "status": "affected", "lessThanOrEqual": "3.5.21", "versionType": "semver" }, { "version": "3.6", "status": "affected", "lessThanOrEqual": "3.6.17", "versionType": "semver" }, { "version": "3.7", "status": "affected", "lessThanOrEqual": "3.7.17", "versionType": "semver" }, { "version": "3.8", "status": "affected", "lessThanOrEqual": "3.8.7", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-104798", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "fetchedAt": "2026-10-23T02:43:41.761Z", "publishedAt": "2026-10-16T04:27:04.876Z", "modifiedAt": "2026-10-16T17:07:17.621Z", "state": "published", "provider": "Wordfence", "title": "My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute", "descriptions": [ { "lang": "en", "value": "The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "joedolson", "product": "My Calendar – Accessible Event Manager", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.4.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "3.5", "lessThanOrEqual": "3.5.21", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "3.6", "lessThanOrEqual": "3.6.17", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "3.7", "lessThanOrEqual": "3.7.17", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "3.8", "lessThanOrEqual": "3.8.7", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L221", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L170", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-shortcodes.php#L102", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-output.php#L1622", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3746389%40my-calendar&new=3746389%40my-calendar", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"joedolson\",\"product\":\"My Calendar – Accessible Event Manager\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.4.24\",\"versionType\":\"semver\"},{\"version\":\"3.5\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.5.21\",\"versionType\":\"semver\"},{\"version\":\"3.6\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.6.17\",\"versionType\":\"semver\"},{\"version\":\"3.7\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.7.17\",\"versionType\":\"semver\"},{\"version\":\"3.8\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.8.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-269 Improper Privilege Management\",\"cweId\":\"CWE-269\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T17:07:17.621Z", "fetchedAt": "2026-10-23T02:43:41.761Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T18:17:20.360Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "My Calendar – Accessible Event Managerに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:02.989Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3076a7abd22a7a31459343287b7637f1a83d11c8ddccddf319729113af7e40b7", "sourceModifiedAt": "2026-10-16T18:17:20.360Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "My Calendar – Accessible Event Manager プラグインのバージョン 3.8.7 以下で、認証されていない攻撃者が `mcs` パラメータを利用し、`above` 属性へのショートコードインジェクションを反射させて特権昇格が可能になる。", "risk": "攻撃者は管理者アカウント（ユーザー ID 1）の認証情報を書き換え、wp‑admin へのフルアクセス権を取得できる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "My Calendar – Accessible Event Manager プラグインのバージョン 3.8.7 以下（3.8.7 を含む）すべてが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "プラグインが有効化されると、自動生成される `/my-calendar/` ページがデフォルトで公開され、誰でもアクセスできる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公開されている GET パラメータ `mcs` の値が、WordPress コアの `do_shortcode` フィルタが実行される前に投稿コンテンツへサニタイズせずに反映される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃者は認証されていなくても、`[my_calendar above=...]` というショートコードを `mcs` パラメータに注入できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "`mc_generate_calendar_nav()` 関数は `above` 属性をカンマで分割し、各要素を `call_user_func()` で実行するが、認証・権限チェックや許可リストがない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "このため、任意の PHP 関数を呼び出すことができ、ショートコードの `$params` 配列が `edit_user()` に渡される。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "`edit_user()` の第1引数 `$user_id` が文字列から整数へ型変換され、`1`（初期管理者ユーザー ID）になるため、管理者アカウントの認証情報が上書きされる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "結果として、攻撃者は wp‑admin へのフルアクセス権を取得できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：joedolson / My Calendar – Accessible Event Manager。影響ありとして記載：3.4.24以下の版。影響ありとして記載：3.5以上、3.5.21以下。影響ありとして記載：3.6以上、3.6.17以下。影響ありとして記載：3.7以上、3.7.17以下。影響ありとして記載：3.8以上、3.8.7以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「My Calendar – Accessible Event Manager」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-104798", "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cve", "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248", "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260", "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L221", "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L170", "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-shortcodes.php#L102", "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-output.php#L1622", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3746389%40my-calendar&new=3746389%40my-calendar", "https://nvd.nist.gov/vuln/detail/CVE-2026-104798" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-104798", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L221", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L170", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-shortcodes.php#L102", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-output.php#L1622", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3746389%40my-calendar&new=3746389%40my-calendar", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104798", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "sourceField": "/containers/cna/title", "excerpt": "My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104798.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"joedolson\",\"product\":\"My Calendar – Accessible Event Manager\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.4.24\",\"versionType\":\"semver\"},{\"version\":\"3.5\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.5.21\",\"versionType\":\"semver\"},{\"version\":\"3.6\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.6.17\",\"versionType\":\"semver\"},{\"version\":\"3.7\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.7.17\",\"versionType\":\"semver\"},{\"version\":\"3.8\",\"status\":\"affected\",\"lessThanOrEqual\":\"3.8.7\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-104798（My Calendar – Accessible Event Manager）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・My Calendar – Accessible Event Manager プラグインのバージョン 3.8.7 以下（3.8.7 を含む）すべてが影響を受ける。\n・プラグインが有効化されると、自動生成される `/my-calendar/` ページがデフォルトで公開され、誰でもアクセスできる。\n・公開されている GET パラメータ `mcs` の値が、WordPress コアの `do_shortcode` フィルタが実行される前に投稿コンテンツへサニタイズせずに反映される。\n・攻撃者は認証されていなくても、`[my_calendar above=...]` というショートコードを `mcs` パラメータに注入できる。\n・`mc_generate_calendar_nav()` 関数は `above` 属性をカンマで分割し、各要素を `call_user_func()` で実行するが、認証・権限チェックや許可リストがない。\n・このため、任意の PHP 関数を呼び出すことができ、ショートコードの `$params` 配列が `edit_user()` に渡される。\n・`edit_user()` の第1引数 `$user_id` が文字列から整数へ型変換され、`1`（初期管理者ユーザー ID）になるため、管理者アカウントの認証情報が上書きされる。\n・結果として、攻撃者は wp‑admin へのフルアクセス権を取得できる。\n・公式の対象表：joedolson / My Calendar – Accessible Event Manager。影響ありとして記載：3.4.24以下の版。影響ありとして記載：3.5以上、3.5.21以下。影響ありとして記載：3.6以上、3.6.17以下。影響ありとして記載：3.7以上、3.7.17以下。影響ありとして記載：3.8以上、3.8.7以下。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-104798", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:02.989Z", "lastSuccess": "2026-10-23T03:21:02.989Z", "sourceCheckedAt": "2026-10-23T02:43:41.761Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-103911", "aliases": [], "title": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder：脆弱性情報", "summary": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder プラグイン（バージョン 1.58.1 以下）は、値の検証が不十分なため、do_shortcode を実行できる。これにより、認証されていない攻撃者が任意のショートコードを実行できる。ブロックテーマを使用したインストールでは、検索結果ページへの単一の未認証 GET リクエスト、またはコメントが有効な投稿への匿名コメント送信により、Forminator 固有のコンテンツや設定がなくても実行できる。", "risk": "任意のショートコードが実行される可能性がある。", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "range": "<= 1.58.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103911", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d922a8f-611f-4586-b8ba-72d18d11a975?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L290", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L167", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103911", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:02.364Z", "modifiedAt": "2026-10-16T15:17:02.770Z", "fetchedAt": "2026-10-23T02:43:41.292Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.", "sourceTitle": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpmudev", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.58.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103911", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "fetchedAt": "2026-10-23T02:43:41.292Z", "publishedAt": "2026-10-16T04:27:02.364Z", "modifiedAt": "2026-10-16T15:09:39.559Z", "state": "published", "provider": "Wordfence", "title": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block", "descriptions": [ { "lang": "en", "value": "The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpmudev", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.58.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d922a8f-611f-4586-b8ba-72d18d11a975?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L290", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L167", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpmudev\",\"product\":\"Forminator Forms – Contact Form, Payment Form & Custom Form Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.58.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-94 Improper Control of Generation of Code ('Code Injection')\",\"cweId\":\"CWE-94\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:39.559Z", "fetchedAt": "2026-10-23T02:43:41.292Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.770Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Forminator Forms – Contact Form, Payment Form & Custom Form Builderに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:03.085Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c2918d0c3da5885700cc131009b77ba4443d8aa630fcf7f51ffca3a98c81045e", "sourceModifiedAt": "2026-10-16T15:17:02.770Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder プラグイン（バージョン 1.58.1 以下）は、値の検証が不十分なため、do_shortcode を実行できる。これにより、認証されていない攻撃者が任意のショートコードを実行できる。ブロックテーマを使用したインストールでは、検索結果ページへの単一の未認証 GET リクエスト、またはコメントが有効な投稿への匿名コメント送信により、Forminator 固有のコンテンツや設定がなくても実行できる。", "risk": "任意のショートコードが実行される可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "WordPress にインストールされた Forminator Forms プラグインのバージョンが 1.58.1 以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "ブロックテーマが使用されている WordPress 環境であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "検索結果ページに対して認証されていない GET リクエストを送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "コメント機能が有効化された投稿に対して匿名コメントを送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Forminator 固有のコンテンツや設定が不要であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wpmudev / Forminator Forms – Contact Form, Payment Form & Custom Form Builder。影響ありとして記載：1.58.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Forminator Forms – Contact Form, Payment Form & Custom Form Builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103911", "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d922a8f-611f-4586-b8ba-72d18d11a975?source=cve", "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L290", "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L167", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "https://nvd.nist.gov/vuln/detail/CVE-2026-103911" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103911", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9d922a8f-611f-4586-b8ba-72d18d11a975?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L290", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L167", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103911", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "sourceField": "/containers/cna/title", "excerpt": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103911.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpmudev\",\"product\":\"Forminator Forms – Contact Form, Payment Form & Custom Form Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.58.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103911（Forminator Forms – Contact Form, Payment Form & Custom Form Builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPress にインストールされた Forminator Forms プラグインのバージョンが 1.58.1 以下であること。\n・ブロックテーマが使用されている WordPress 環境であること。\n・検索結果ページに対して認証されていない GET リクエストを送信できること。\n・コメント機能が有効化された投稿に対して匿名コメントを送信できること。\n・Forminator 固有のコンテンツや設定が不要であること。\n・公式の対象表：wpmudev / Forminator Forms – Contact Form, Payment Form & Custom Form Builder。影響ありとして記載：1.58.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103911", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:03.085Z", "lastSuccess": "2026-10-23T03:21:03.085Z", "sourceCheckedAt": "2026-10-23T02:43:41.292Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-103895", "aliases": [], "title": "miniOrange OTP Login, Verification and SMS Notifications：認証の回避", "summary": "miniOrange OTP Login, Verification and SMS Notifications プラグイン（バージョン 5.5.8 以下）は、`mo_by_pass_login()` 関数を通じて認証バイパスが可能です。`mo_delay_otp_process()` がパスワード検証や管理者意図のチェック（5.5.6 で追加）より前に認証フローを中断し、Delay OTP の猶予フラグ（`mov_last_verified_dttm`）がユーザー ID のみで `user_meta` に保存され、セッションやクッキー、IP アドレス、デバイスに紐付いていないため、認証されていない攻撃者が任意の WordPress ユーザー（管理者含む）としてログインできるようになります。攻撃者は既知のユーザー名と `mo_wp_login_intent=otp` パラメータ、空でない任意のパスワードを送信するだけで、正しい認証情報を提供せずに Delay OTP の猶予ウィンドウを利用して認証できます。この脆弱性を利用するには、サイトが OTP のみログイン（`wp_login_skip_password=1`、`wp_login_skip_password_fallback=0`）と Delay OTP 検証（`wp_login_delay_otp=1`）を有効にしており、対象アカウントが現在設定された Delay OTP の間隔内にある必要があります。", "risk": "認証されていない攻撃者が正しい認証情報を持たなくても、任意の WordPress ユーザー（管理者を含む）としてログインできる可能性があります。", "product": "miniOrange OTP Login, Verification and SMS Notifications", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "miniOrange OTP Login, Verification and SMS Notifications", "range": "<= 5.5.8" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103895", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L511", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1573", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1050", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1170", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1519", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wploginform.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103895", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:26:59.302Z", "modifiedAt": "2026-10-16T16:16:54.177Z", "fetchedAt": "2026-10-23T02:43:41.276Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.", "sourceTitle": "miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "cyberlord92", "product": "miniOrange OTP Login, Verification and SMS Notifications", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "5.5.8", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103895", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "fetchedAt": "2026-10-23T02:43:41.276Z", "publishedAt": "2026-10-16T04:26:59.302Z", "modifiedAt": "2026-10-16T15:45:41.000Z", "state": "published", "provider": "Wordfence", "title": "miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State", "descriptions": [ { "lang": "en", "value": "The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "cyberlord92", "product": "miniOrange OTP Login, Verification and SMS Notifications", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "5.5.8", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L511", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1573", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1050", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1170", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1519", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wploginform.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"cyberlord92\",\"product\":\"miniOrange OTP Login, Verification and SMS Notifications\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.5.8\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-287 Improper Authentication\",\"cweId\":\"CWE-287\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:45:41.000Z", "fetchedAt": "2026-10-23T02:43:41.276Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T16:16:54.177Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "miniOrange OTP Login, Verification and SMS Notificationsに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:03.313Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "cfce87fa409990eb394600bf1c8f7fb1f49c3b79e687d2046008b558d7c6021c", "sourceModifiedAt": "2026-10-16T16:16:54.177Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "miniOrange OTP Login, Verification and SMS Notifications プラグイン（バージョン 5.5.8 以下）は、`mo_by_pass_login()` 関数を通じて認証バイパスが可能です。`mo_delay_otp_process()` がパスワード検証や管理者意図のチェック（5.5.6 で追加）より前に認証フローを中断し、Delay OTP の猶予フラグ（`mov_last_verified_dttm`）がユーザー ID のみで `user_meta` に保存され、セッションやクッキー、IP アドレス、デバイスに紐付いていないため、認証されていない攻撃者が任意の WordPress ユーザー（管理者含む）としてログインできるようになります。攻撃者は既知のユーザー名と `mo_wp_login_intent=otp` パラメータ、空でない任意のパスワードを送信するだけで、正しい認証情報を提供せずに Delay OTP の猶予ウィンドウを利用して認証できます。この脆弱性を利用するには、サイトが OTP のみログイン（`wp_login_skip_password=1`、`wp_login_skip_password_fallback=0`）と Delay OTP 検証（`wp_login_delay_otp=1`）を有効にしており、対象アカウントが現在設定された Delay OTP の間隔内にある必要があります。", "risk": "認証されていない攻撃者が正しい認証情報を持たなくても、任意の WordPress ユーザー（管理者を含む）としてログインできる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインのバージョンが 5.5.8 以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "サイトが OTP のみログインを有効にしていること（`wp_login_skip_password=1`、`wp_login_skip_password_fallback=0`）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Delay OTP 検証が有効になっていること（`wp_login_delay_otp=1`）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "対象アカウントが現在設定された Delay OTP の猶予期間内にあること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Delay OTP の猶予フラグ（`mov_last_verified_dttm`）がユーザー ID のみで `user_meta` に保存され、セッションやクッキー、IP アドレス、デバイスに紐付いていないこと。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：cyberlord92 / miniOrange OTP Login, Verification and SMS Notifications。影響ありとして記載：5.5.8以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「miniOrange OTP Login, Verification and SMS Notifications」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103895", "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve", "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L511", "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1573", "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1050", "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1170", "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1519", "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261", "https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wploginform.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-103895" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103895", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L511", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1573", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1050", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1170", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1519", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wploginform.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103895", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "sourceField": "/containers/cna/title", "excerpt": "miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103895.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"cyberlord92\",\"product\":\"miniOrange OTP Login, Verification and SMS Notifications\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.5.8\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103895（miniOrange OTP Login, Verification and SMS Notifications）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインのバージョンが 5.5.8 以下であること。\n・サイトが OTP のみログインを有効にしていること（`wp_login_skip_password=1`、`wp_login_skip_password_fallback=0`）。\n・Delay OTP 検証が有効になっていること（`wp_login_delay_otp=1`）。\n・対象アカウントが現在設定された Delay OTP の猶予期間内にあること。\n・Delay OTP の猶予フラグ（`mov_last_verified_dttm`）がユーザー ID のみで `user_meta` に保存され、セッションやクッキー、IP アドレス、デバイスに紐付いていないこと。\n・公式の対象表：cyberlord92 / miniOrange OTP Login, Verification and SMS Notifications。影響ありとして記載：5.5.8以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103895", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:03.313Z", "lastSuccess": "2026-10-23T03:21:03.313Z", "sourceCheckedAt": "2026-10-23T02:43:41.276Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-103525", "aliases": [], "title": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler：情報の漏えい", "summary": "FluentCart プラグイン（WordPress 用）は、'order_id' と 'billing_address_id'（または 'shipping_address_id'）パラメータに対する検証が欠如しているため、認証されていない攻撃者がこれらの値を自由に設定でき、順番に増える ID を列挙することで、他の顧客の請求先・配送先住所などの個人情報（住所、都市、州、郵便番号、電話番号、会社名、VAT 番号、法人登録番号）を読み取って取得できる脆弱性があります。さらに、該当する AJAX エンドポイントは 60 秒あたり 5 回という緩やかなレートリミットしか設けておらず、認証や所有権の確認は行われません。", "risk": "攻撃者が他の顧客の請求先・配送先住所などの個人情報を読み取り、外部に漏洩させる可能性があります。", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "range": "<= 1.7.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103525", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8375a8f4-274d-4c4f-8833-067efc7e57a2?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L338", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L369", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Hooks/Cart/WebCheckoutHandler.php#L132", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L124", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3734886%40fluent-cart&new=3734886%40fluent-cart", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103525", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:00.357Z", "modifiedAt": "2026-10-16T15:17:02.273Z", "fetchedAt": "2026-10-23T02:43:41.150Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.", "sourceTitle": "FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpmanageninja", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.7.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103525", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "fetchedAt": "2026-10-23T02:43:41.150Z", "publishedAt": "2026-10-16T04:27:00.357Z", "modifiedAt": "2026-10-16T15:09:40.130Z", "state": "published", "provider": "Wordfence", "title": "FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters", "descriptions": [ { "lang": "en", "value": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpmanageninja", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.7.0", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8375a8f4-274d-4c4f-8833-067efc7e57a2?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L338", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L369", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Hooks/Cart/WebCheckoutHandler.php#L132", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L124", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3734886%40fluent-cart&new=3734886%40fluent-cart", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpmanageninja\",\"product\":\"FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.7.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-639 Authorization Bypass Through User-Controlled Key\",\"cweId\":\"CWE-639\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:40.130Z", "fetchedAt": "2026-10-23T02:43:41.150Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.273Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simplerに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:03.386Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "dbd9b2863c438a7b99248c43ce4862254f919f6f9890f866f80cd120448a6035", "sourceModifiedAt": "2026-10-16T15:17:02.273Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FluentCart プラグイン（WordPress 用）は、'order_id' と 'billing_address_id'（または 'shipping_address_id'）パラメータに対する検証が欠如しているため、認証されていない攻撃者がこれらの値を自由に設定でき、順番に増える ID を列挙することで、他の顧客の請求先・配送先住所などの個人情報（住所、都市、州、郵便番号、電話番号、会社名、VAT 番号、法人登録番号）を読み取って取得できる脆弱性があります。さらに、該当する AJAX エンドポイントは 60 秒あたり 5 回という緩やかなレートリミットしか設けておらず、認証や所有権の確認は行われません。", "risk": "攻撃者が他の顧客の請求先・配送先住所などの個人情報を読み取り、外部に漏洩させる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は WordPress 用 FluentCart プラグインのバージョン 1.7.0 以下すべてです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者は認証されていない状態で操作できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性は 'order_id' と 'billing_address_id'（または 'shipping_address_id'）パラメータを受け取る AJAX エンドポイントで発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "これらのパラメータはユーザーが制御でき、サーバ側での検証が行われていません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "アドレス再利用を防止するはずの id 等価ガードは、攻撃者が両方の ID を操作できるため回避可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "該当 AJAX エンドポイントは 60 秒あたり 5 リクエストという緩やかなレートリミットしか設けておらず、認証や所有権のチェックはありません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wpmanageninja / FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler。影響ありとして記載：1.7.0以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103525", "https://www.wordfence.com/threat-intel/vulnerabilities/id/8375a8f4-274d-4c4f-8833-067efc7e57a2?source=cve", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L338", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L369", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Hooks/Cart/WebCheckoutHandler.php#L132", "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L124", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3734886%40fluent-cart&new=3734886%40fluent-cart", "https://nvd.nist.gov/vuln/detail/CVE-2026-103525" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103525", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8375a8f4-274d-4c4f-8833-067efc7e57a2?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L338", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L369", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Hooks/Cart/WebCheckoutHandler.php#L132", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L124", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3734886%40fluent-cart&new=3734886%40fluent-cart", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103525", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "sourceField": "/containers/cna/title", "excerpt": "FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103525.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpmanageninja\",\"product\":\"FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.7.0\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103525（FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は WordPress 用 FluentCart プラグインのバージョン 1.7.0 以下すべてです。\n・攻撃者は認証されていない状態で操作できます。\n・脆弱性は 'order_id' と 'billing_address_id'（または 'shipping_address_id'）パラメータを受け取る AJAX エンドポイントで発生します。\n・これらのパラメータはユーザーが制御でき、サーバ側での検証が行われていません。\n・アドレス再利用を防止するはずの id 等価ガードは、攻撃者が両方の ID を操作できるため回避可能です。\n・該当 AJAX エンドポイントは 60 秒あたり 5 リクエストという緩やかなレートリミットしか設けておらず、認証や所有権のチェックはありません。\n・公式の対象表：wpmanageninja / FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler。影響ありとして記載：1.7.0以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103525", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:03.386Z", "lastSuccess": "2026-10-23T03:21:03.386Z", "sourceCheckedAt": "2026-10-23T02:43:41.150Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-103481", "aliases": [], "title": "Gwolle Guestbook：ブラウザー上での不正な処理", "summary": "Gwolle Guestbook プラグイン（バージョン 5.1.1 以下）において、'permalink' パラメータの入力検証と出力エスケープが不十分なため、リフレクティッド XSS が発生します。認証されていない攻撃者が任意のウェブスクリプトを注入でき、ユーザーがリンクをクリックするなどの操作を騙されると、そのスクリプトが実行されます。", "risk": "攻撃者が任意のウェブスクリプトをページに埋め込めるため、ユーザーがリンクをクリックすると不正な処理が実行されます。", "product": "Gwolle Guestbook", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.1, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "affected": [ { "product": "Gwolle Guestbook", "range": "<= 5.1.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103481", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8eff266-43fe-4636-b4ef-c973db7e7952?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L28", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L21", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-ajax-infinite-scroll.php#L96", "label": "security@wordfence.com" }, { "url": "https://codeberg.org/cyclotouriste/gwolle-gb/commit/f6e483654b56188a3fa208fd18a4f0468577a825", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103481", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:27:04.530Z", "modifiedAt": "2026-10-16T15:17:02.040Z", "fetchedAt": "2026-10-23T02:43:41.083Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "sourceTitle": "Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "mpol", "product": "Gwolle Guestbook", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "5.1.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-103481", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "fetchedAt": "2026-10-23T02:43:41.083Z", "publishedAt": "2026-10-16T04:27:04.530Z", "modifiedAt": "2026-10-16T14:39:05.468Z", "state": "published", "provider": "Wordfence", "title": "Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter", "descriptions": [ { "lang": "en", "value": "The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "mpol", "product": "Gwolle Guestbook", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "5.1.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8eff266-43fe-4636-b4ef-c973db7e7952?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L28", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L21", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-ajax-infinite-scroll.php#L96", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://codeberg.org/cyclotouriste/gwolle-gb/commit/f6e483654b56188a3fa208fd18a4f0468577a825", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"mpol\",\"product\":\"Gwolle Guestbook\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.1.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:05.468Z", "fetchedAt": "2026-10-23T02:43:41.083Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:02.040Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Gwolle Guestbookにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:04.271Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c572cc97f9c42971a7b1769ff8ba05c2408c5a4a9ecc63012a8330d0ba1d43b0", "sourceModifiedAt": "2026-10-16T15:17:02.040Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Gwolle Guestbook プラグイン（バージョン 5.1.1 以下）において、'permalink' パラメータの入力検証と出力エスケープが不十分なため、リフレクティッド XSS が発生します。認証されていない攻撃者が任意のウェブスクリプトを注入でき、ユーザーがリンクをクリックするなどの操作を騙されると、そのスクリプトが実行されます。", "risk": "攻撃者が任意のウェブスクリプトをページに埋め込めるため、ユーザーがリンクをクリックすると不正な処理が実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "WordPress 用プラグイン Gwolle Guestbook のバージョン 5.1.1 以下すべてが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "公式の対象表：mpol / Gwolle Guestbook。影響ありとして記載：5.1.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Gwolle Guestbook」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-103481", "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8eff266-43fe-4636-b4ef-c973db7e7952?source=cve", "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L28", "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L21", "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-ajax-infinite-scroll.php#L96", "https://codeberg.org/cyclotouriste/gwolle-gb/commit/f6e483654b56188a3fa208fd18a4f0468577a825", "https://nvd.nist.gov/vuln/detail/CVE-2026-103481" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103481", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8eff266-43fe-4636-b4ef-c973db7e7952?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L28", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L21", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-ajax-infinite-scroll.php#L96", "label": "security@wordfence.com" }, { "url": "https://codeberg.org/cyclotouriste/gwolle-gb/commit/f6e483654b56188a3fa208fd18a4f0468577a825", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103481", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "sourceField": "/containers/cna/title", "excerpt": "Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/103xxx/CVE-2026-103481.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"mpol\",\"product\":\"Gwolle Guestbook\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.1.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-103481（Gwolle Guestbook）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPress 用プラグイン Gwolle Guestbook のバージョン 5.1.1 以下すべてが影響を受けます。\n・公式の対象表：mpol / Gwolle Guestbook。影響ありとして記載：5.1.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-103481", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:04.271Z", "lastSuccess": "2026-10-23T03:21:04.271Z", "sourceCheckedAt": "2026-10-23T02:43:41.083Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-101335", "aliases": [], "title": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder：情報の漏えい", "summary": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder プラグイン（バージョン 1.58.1 まで）では、クイズの通知テンプレートに {quiz_result} マージタグが含まれている場合、{user_agent} と {refer_url} のマージタグが置換された後に do_shortcode() が実行されます。このとき、User‑Agent ヘッダーと referer_url POST パラメータに含まれる攻撃者が自由に書き換えた文字列が sanitize_text_field()／esc_html() を通過しますが、'[' と ']' のショートコード区切り文字は除去されません。その結果、認証されていない攻撃者が任意の WordPress ショートコードを実行できるようになります。", "risk": "任意のショートコードが実行されることで、サイト上に不正なコンテンツが挿入されたり、他のプラグインやテーマが提供する情報が漏洩したりする可能性があります。", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "range": "<= 1.58.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-101335", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L2965", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1652", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1476", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/quizzes/front/front-mail.php#L36", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101335", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T04:26:58.967Z", "modifiedAt": "2026-10-16T15:16:58.983Z", "fetchedAt": "2026-10-23T02:43:40.803Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.", "sourceTitle": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wpmudev", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.58.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-101335", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "fetchedAt": "2026-10-23T02:43:40.803Z", "publishedAt": "2026-10-16T04:26:58.967Z", "modifiedAt": "2026-10-16T15:09:40.456Z", "state": "published", "provider": "Wordfence", "title": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags", "descriptions": [ { "lang": "en", "value": "The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wpmudev", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.58.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L2965", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1652", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1476", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/quizzes/front/front-mail.php#L36", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wpmudev\",\"product\":\"Forminator Forms – Contact Form, Payment Form & Custom Form Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.58.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-94 Improper Control of Generation of Code ('Code Injection')\",\"cweId\":\"CWE-94\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:40.456Z", "fetchedAt": "2026-10-23T02:43:40.803Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:16:58.983Z", "fetchedAt": "2026-10-22T22:09:15.099Z", "state": "published" } ], "sourceSummary": "Forminator Forms – Contact Form, Payment Form & Custom Form Builderに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:06.684Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5b46486d70a705daf479b2e6bb91e1ccd21706438a43e130985daeb853cb52d9", "sourceModifiedAt": "2026-10-16T15:16:58.983Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder プラグイン（バージョン 1.58.1 まで）では、クイズの通知テンプレートに {quiz_result} マージタグが含まれている場合、{user_agent} と {refer_url} のマージタグが置換された後に do_shortcode() が実行されます。このとき、User‑Agent ヘッダーと referer_url POST パラメータに含まれる攻撃者が自由に書き換えた文字列が sanitize_text_field()／esc_html() を通過しますが、'[' と ']' のショートコード区切り文字は除去されません。その結果、認証されていない攻撃者が任意の WordPress ショートコードを実行できるようになります。", "risk": "任意のショートコードが実行されることで、サイト上に不正なコンテンツが挿入されたり、他のプラグインやテーマが提供する情報が漏洩したりする可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Forminator Forms プラグインのバージョンが 1.58.1 以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "クイズ機能を使用し、通知テンプレートに {quiz_result} マージタグが含まれていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者が認証なしで HTTP リクエストを送信でき、User‑Agent ヘッダーに任意の文字列を設定できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者が POST パラメータ referer_url に任意の文字列を設定できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "sanitize_text_field() と esc_html() が '[' と ']' を除去しないため、ショートコードがそのまま残ること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "サイトにインストールされている他のプラグインやテーマがショートコードを登録していること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wpmudev / Forminator Forms – Contact Form, Payment Form & Custom Form Builder。影響ありとして記載：1.58.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Forminator Forms – Contact Form, Payment Form & Custom Form Builder」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-101335", "https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=cve", "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L2965", "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1652", "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1476", "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/quizzes/front/front-mail.php#L36", "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "https://nvd.nist.gov/vuln/detail/CVE-2026-101335" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-101335", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L2965", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1652", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1476", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/quizzes/front/front-mail.php#L36", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101335", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "sourceField": "/containers/cna/title", "excerpt": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101335.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wpmudev\",\"product\":\"Forminator Forms – Contact Form, Payment Form & Custom Form Builder\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.58.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-101335（Forminator Forms – Contact Form, Payment Form & Custom Form Builder）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Forminator Forms プラグインのバージョンが 1.58.1 以下であること。\n・クイズ機能を使用し、通知テンプレートに {quiz_result} マージタグが含まれていること。\n・攻撃者が認証なしで HTTP リクエストを送信でき、User‑Agent ヘッダーに任意の文字列を設定できること。\n・攻撃者が POST パラメータ referer_url に任意の文字列を設定できること。\n・sanitize_text_field() と esc_html() が '[' と ']' を除去しないため、ショートコードがそのまま残ること。\n・サイトにインストールされている他のプラグインやテーマがショートコードを登録していること。\n・公式の対象表：wpmudev / Forminator Forms – Contact Form, Payment Form & Custom Form Builder。影響ありとして記載：1.58.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-101335", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:06.684Z", "lastSuccess": "2026-10-23T03:21:06.684Z", "sourceCheckedAt": "2026-10-23T02:43:40.803Z", "errorCode": null }, "glossary": [ { "term": "POST", "meaning": "フォームなどのデータを、相手のサーバーへ送るための通信方法です。この言葉だけで、情報漏えいや設定変更が起きたと判断するものではありません。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Methods/POST", "kind": "general_definition" } ] } }, { "id": "CVE-2026-97339", "aliases": [], "title": "Complianz GDPR/CCPA Cookie Consent Banner：ブラウザー上での不正な処理", "summary": "Complianz GDPR/CCPA Cookie Consent Banner プラグイン（バージョン 7.5.5 以下）において、未認証の攻撃者がコメント内容を通じて yotu-wp Cookie-Blocker フィルタを利用し、保存型クロスサイトスクリプティング（XSS）を実行できる脆弱性があります。", "risk": "攻撃者が埋め込んだ任意のウェブスクリプトが、ページを閲覧したユーザーのブラウザーで実行されます。", "product": "Complianz GDPR/CCPA Cookie Consent Banner", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Complianz GDPR/CCPA Cookie Consent Banner", "range": "<= 7.5.5" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97339", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c12e65c-eedf-4fc2-977a-7a07219ee1c2?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L18", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L7", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L828", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L458", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743098/complianz-gdpr/trunk/integrations/plugins/yotu-wp.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97339", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:41.150Z", "modifiedAt": "2026-10-16T17:18:01.900Z", "fetchedAt": "2026-10-23T02:43:53.788Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.", "sourceTitle": "Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "complianz", "product": "Complianz GDPR/CCPA Cookie Consent Banner", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "7.5.5", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-97339", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "fetchedAt": "2026-10-23T02:43:53.788Z", "publishedAt": "2026-10-16T03:38:41.150Z", "modifiedAt": "2026-10-16T16:19:33.306Z", "state": "published", "provider": "Wordfence", "title": "Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter", "descriptions": [ { "lang": "en", "value": "The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "complianz", "product": "Complianz GDPR/CCPA Cookie Consent Banner", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "7.5.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c12e65c-eedf-4fc2-977a-7a07219ee1c2?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L18", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L7", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L828", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L458", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743098/complianz-gdpr/trunk/integrations/plugins/yotu-wp.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"complianz\",\"product\":\"Complianz GDPR/CCPA Cookie Consent Banner\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.5.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T16:19:33.306Z", "fetchedAt": "2026-10-23T02:43:53.788Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T17:18:01.900Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "state": "published" } ], "sourceSummary": "Complianz GDPR/CCPA Cookie Consent Bannerにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:06.942Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e31c735f1fcf04948b64b6218bcd9b169059adcd292fb5583d17fe4e9fba1891", "sourceModifiedAt": "2026-10-16T17:18:01.900Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Complianz GDPR/CCPA Cookie Consent Banner プラグイン（バージョン 7.5.5 以下）において、未認証の攻撃者がコメント内容を通じて yotu-wp Cookie-Blocker フィルタを利用し、保存型クロスサイトスクリプティング（XSS）を実行できる脆弱性があります。", "risk": "攻撃者が埋め込んだ任意のウェブスクリプトが、ページを閲覧したユーザーのブラウザーで実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "対象プラグインのバージョンが 7.5.5 以下であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "WordPress 環境で yotu-wp Cookie-Blocker フィルタが有効になっていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "コメントが投稿され、管理者によって承認された状態であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃者が認証されていない（未ログイン）状態でコメントを投稿できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "プラグインが入力のサニタイズと出力エスケープを十分に行わないこと。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "プラグインの出力バッファフィルタが str_replace による置換を行い、属性コンテキストから抜け出す形でスクリプトが実行されること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：complianz / Complianz GDPR/CCPA Cookie Consent Banner。影響ありとして記載：7.5.5以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Complianz GDPR/CCPA Cookie Consent Banner」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-97339", "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c12e65c-eedf-4fc2-977a-7a07219ee1c2?source=cve", "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L18", "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L7", "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L828", "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L458", "https://plugins.trac.wordpress.org/changeset/3743098/complianz-gdpr/trunk/integrations/plugins/yotu-wp.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-97339" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97339", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c12e65c-eedf-4fc2-977a-7a07219ee1c2?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L18", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/integrations/plugins/yotu-wp.php#L7", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L828", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.5.5/class-cookie-blocker.php#L458", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3743098/complianz-gdpr/trunk/integrations/plugins/yotu-wp.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97339", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "sourceField": "/containers/cna/title", "excerpt": "Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress's wp_kses comment sanitization because the payload uses only allow-listed tags and hides executable tokens inside quoted attribute values as plain text; the XSS is only realized when Complianz's own output-buffer filter performs str_replace() rewrites that break out of the attribute context, and requires the comment to be approved before it executes for visitors.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97339.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"complianz\",\"product\":\"Complianz GDPR/CCPA Cookie Consent Banner\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"7.5.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-97339（Complianz GDPR/CCPA Cookie Consent Banner）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインのバージョンが 7.5.5 以下であること。\n・WordPress 環境で yotu-wp Cookie-Blocker フィルタが有効になっていること。\n・コメントが投稿され、管理者によって承認された状態であること。\n・攻撃者が認証されていない（未ログイン）状態でコメントを投稿できること。\n・プラグインが入力のサニタイズと出力エスケープを十分に行わないこと。\n・プラグインの出力バッファフィルタが str_replace による置換を行い、属性コンテキストから抜け出す形でスクリプトが実行されること。\n・公式の対象表：complianz / Complianz GDPR/CCPA Cookie Consent Banner。影響ありとして記載：7.5.5以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-97339", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:06.942Z", "lastSuccess": "2026-10-23T03:21:06.942Z", "sourceCheckedAt": "2026-10-23T02:43:53.788Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-93953", "aliases": [], "title": "Backuply – Backup, Restore, Migrate and Clone：権限の奪取", "summary": "Backuply – Backup, Restore, Migrate and Clone プラグイン（WordPress 用）は、バージョン 1.5.8 までのすべてで、Biographical Info フィールドに入力されたデータがバックアップの SQL ダンプにそのまま書き込まれ、管理者がそのバックアップを復元した際に INSERT 文から抜け出した攻撃者制御の SQL が実行されます。認証済みのサブスクライバー以上のユーザーがこのペイロードを仕込むことで、データベースのフル権限で任意のデータを書き換え、default_role を administrator に変更しオープンユーザー登録を有効にでき、結果として新規登録アカウントが自動的に管理者権限を得てサイト全体が乗っ取られます。", "risk": "攻撃者がデータベースの権限で任意のデータを書き換え、default_role を administrator に変更しオープンユーザー登録を有効にできるため、以後登録されるアカウントが自動的に管理者権限を取得し、サイト全体が乗っ取られる可能性があります。", "product": "Backuply – Backup, Restore, Migrate and Clone", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 8, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "affected": [ { "product": "Backuply – Backup, Restore, Migrate and Clone", "range": "<= 1.5.8" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93953", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/202a2d02-a069-43d1-9ebe-59828e828c03?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2255", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2247", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L592", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L140", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3723257/backuply", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93953", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:40.799Z", "modifiedAt": "2026-10-16T15:17:36.293Z", "fetchedAt": "2026-10-23T02:43:53.013Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.", "sourceTitle": "Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "softaculous", "product": "Backuply – Backup, Restore, Migrate and Clone", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.5.8", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-93953", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "fetchedAt": "2026-10-23T02:43:53.013Z", "publishedAt": "2026-10-16T03:38:40.799Z", "modifiedAt": "2026-10-16T15:09:41.205Z", "state": "published", "provider": "Wordfence", "title": "Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation", "descriptions": [ { "lang": "en", "value": "The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "softaculous", "product": "Backuply – Backup, Restore, Migrate and Clone", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.5.8", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/202a2d02-a069-43d1-9ebe-59828e828c03?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2255", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2247", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L592", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L140", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/changeset/3723257/backuply", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"softaculous\",\"product\":\"Backuply – Backup, Restore, Migrate and Clone\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.5.8\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"cweId\":\"CWE-89\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:41.205Z", "fetchedAt": "2026-10-23T02:43:53.013Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:36.293Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Backuply – Backup, Restore, Migrate and Cloneに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:06.980Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "589985253e527e886b6c7fa8b4a9ed3237f9858557b01403a54cef4d32274d22", "sourceModifiedAt": "2026-10-16T15:17:36.293Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Backuply – Backup, Restore, Migrate and Clone プラグイン（WordPress 用）は、バージョン 1.5.8 までのすべてで、Biographical Info フィールドに入力されたデータがバックアップの SQL ダンプにそのまま書き込まれ、管理者がそのバックアップを復元した際に INSERT 文から抜け出した攻撃者制御の SQL が実行されます。認証済みのサブスクライバー以上のユーザーがこのペイロードを仕込むことで、データベースのフル権限で任意のデータを書き換え、default_role を administrator に変更しオープンユーザー登録を有効にでき、結果として新規登録アカウントが自動的に管理者権限を得てサイト全体が乗っ取られます。", "risk": "攻撃者がデータベースの権限で任意のデータを書き換え、default_role を administrator に変更しオープンユーザー登録を有効にできるため、以後登録されるアカウントが自動的に管理者権限を取得し、サイト全体が乗っ取られる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Backuply – Backup, Restore, Migrate and Clone プラグインのすべてのバージョン（1.5.8 以下）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者はサブスクライバー以上の認証済みユーザーである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者はユーザーの「Biographical Info」フィールドに SQL ペイロードを入力できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バックアップ作成時に、Biographical Info の値が wp_usermeta テーブルへの INSERT 文にそのまま書き込まれ、SQL ダンプに保存されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "管理者がそのバックアップを復元すると、INSERT 文の中でペイロードが抜け出し、攻撃者が制御する SQL が実行されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "実行される SQL はデータベースのフル権限で動作し、任意のデータを書き換えることができます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "具体的には wp_options テーブルの default_role オプションを 'administrator' に変更し、オープンユーザー登録を有効にできます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "その結果、以後新規に登録されたアカウントは自動的に管理者権限を取得し、サイト全体が乗っ取られます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：softaculous / Backuply – Backup, Restore, Migrate and Clone。影響ありとして記載：1.5.8以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Backuply – Backup, Restore, Migrate and Clone」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-93953", "https://www.wordfence.com/threat-intel/vulnerabilities/id/202a2d02-a069-43d1-9ebe-59828e828c03?source=cve", "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2255", "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2247", "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L592", "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L140", "https://plugins.trac.wordpress.org/changeset/3723257/backuply", "https://nvd.nist.gov/vuln/detail/CVE-2026-93953" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93953", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/202a2d02-a069-43d1-9ebe-59828e828c03?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2255", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2247", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L592", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L140", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3723257/backuply", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93953", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "sourceField": "/containers/cna/title", "excerpt": "Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93953.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"softaculous\",\"product\":\"Backuply – Backup, Restore, Migrate and Clone\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.5.8\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-93953（Backuply – Backup, Restore, Migrate and Clone）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Backuply – Backup, Restore, Migrate and Clone プラグインのすべてのバージョン（1.5.8 以下）が影響を受けます。\n・攻撃者はサブスクライバー以上の認証済みユーザーである必要があります。\n・攻撃者はユーザーの「Biographical Info」フィールドに SQL ペイロードを入力できます。\n・バックアップ作成時に、Biographical Info の値が wp_usermeta テーブルへの INSERT 文にそのまま書き込まれ、SQL ダンプに保存されます。\n・管理者がそのバックアップを復元すると、INSERT 文の中でペイロードが抜け出し、攻撃者が制御する SQL が実行されます。\n・実行される SQL はデータベースのフル権限で動作し、任意のデータを書き換えることができます。\n・具体的には wp_options テーブルの default_role オプションを 'administrator' に変更し、オープンユーザー登録を有効にできます。\n・その結果、以後新規に登録されたアカウントは自動的に管理者権限を取得し、サイト全体が乗っ取られます。\n・公式の対象表：softaculous / Backuply – Backup, Restore, Migrate and Clone。影響ありとして記載：1.5.8以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-93953", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:06.980Z", "lastSuccess": "2026-10-23T03:21:06.980Z", "sourceCheckedAt": "2026-10-23T02:43:53.013Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-93535", "aliases": [], "title": "Dark Mode – Improve Accessibility with AI Powered Dark Theme：ブラウザー上での不正な処理", "summary": "Dark Mode – Improve Accessibility with AI Powered Dark Theme プラグイン（バージョン 5.3.17 以下）は、'icon_light' ショートコード属性の入力検証と出力エスケープが不十分なため、認証済みの攻撃者（Contributor 以上の権限）により保存型クロスサイトスクリプティングが可能です。", "risk": "攻撃者が任意のウェブスクリプトをページに埋め込めるため、ページを閲覧したユーザーのブラウザーで不正な処理が実行されます。", "product": "Dark Mode – Improve Accessibility with AI Powered Dark Theme", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Dark Mode – Improve Accessibility with AI Powered Dark Theme", "range": "<= 5.3.17" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93535", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/023b70db-da91-4a35-9d1f-9c90534f29d0?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3704136/", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93535", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:39.317Z", "modifiedAt": "2026-10-16T15:17:36.073Z", "fetchedAt": "2026-10-23T02:43:52.804Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "sourceTitle": "WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "wppool", "product": "Dark Mode – Improve Accessibility with AI Powered Dark Theme", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "5.3.17", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-93535", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "fetchedAt": "2026-10-23T02:43:52.804Z", "publishedAt": "2026-10-16T03:38:39.317Z", "modifiedAt": "2026-10-16T14:39:06.770Z", "state": "published", "provider": "Wordfence", "title": "WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute", "descriptions": [ { "lang": "en", "value": "The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "wppool", "product": "Dark Mode – Improve Accessibility with AI Powered Dark Theme", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "5.3.17", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/023b70db-da91-4a35-9d1f-9c90534f29d0?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/changeset/3704136/", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"wppool\",\"product\":\"Dark Mode – Improve Accessibility with AI Powered Dark Theme\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.3.17\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T14:39:06.770Z", "fetchedAt": "2026-10-23T02:43:52.804Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:36.073Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Dark Mode – Improve Accessibility with AI Powered Dark Themeにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:07.316Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "04b1152e417d894afa33e1851a230ff42c0e7c512fd605336524515d4acd72cd", "sourceModifiedAt": "2026-10-16T15:17:36.073Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Dark Mode – Improve Accessibility with AI Powered Dark Theme プラグイン（バージョン 5.3.17 以下）は、'icon_light' ショートコード属性の入力検証と出力エスケープが不十分なため、認証済みの攻撃者（Contributor 以上の権限）により保存型クロスサイトスクリプティングが可能です。", "risk": "攻撃者が任意のウェブスクリプトをページに埋め込めるため、ページを閲覧したユーザーのブラウザーで不正な処理が実行されます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証済みの攻撃者が Contributor レベル以上の権限を持っている場合に、'icon_light' ショートコード属性を利用してスクリプトを注入できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：wppool / Dark Mode – Improve Accessibility with AI Powered Dark Theme。影響ありとして記載：5.3.17以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Dark Mode – Improve Accessibility with AI Powered Dark Theme」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-93535", "https://www.wordfence.com/threat-intel/vulnerabilities/id/023b70db-da91-4a35-9d1f-9c90534f29d0?source=cve", "https://plugins.trac.wordpress.org/changeset/3704136/", "https://nvd.nist.gov/vuln/detail/CVE-2026-93535" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93535", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/023b70db-da91-4a35-9d1f-9c90534f29d0?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3704136/", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93535", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "sourceField": "/containers/cna/title", "excerpt": "WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93535.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"wppool\",\"product\":\"Dark Mode – Improve Accessibility with AI Powered Dark Theme\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.3.17\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-93535（Dark Mode – Improve Accessibility with AI Powered Dark Theme）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証済みの攻撃者が Contributor レベル以上の権限を持っている場合に、'icon_light' ショートコード属性を利用してスクリプトを注入できます。\n・公式の対象表：wppool / Dark Mode – Improve Accessibility with AI Powered Dark Theme。影響ありとして記載：5.3.17以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-93535", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:07.316Z", "lastSuccess": "2026-10-23T03:21:07.316Z", "sourceCheckedAt": "2026-10-23T02:43:52.804Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-89280", "aliases": [], "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy：脆弱性情報", "summary": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution のバージョン5.2.1以下において、'password' パラメータの検証が欠如しているため、認証済みでカスタム+以上の権限を持つ攻撃者が /wp-json/dokan/v1/customers/{id} エンドポイントに対して任意の顧客のパスワードを変更できる。対象となる顧客は、攻撃者が運営するベンダーに対して少なくとも1件の注文を行っている必要がある。この操作により攻撃者はその顧客としてログインでき、限定的なアカウント乗っ取りが可能になる。", "risk": "攻撃者が顧客のパスワードを変更できるため、顧客としてログインでき、限定的なアカウント乗っ取りが起こる可能性がある。", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy", "range": "<= 5.2.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89280", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L227", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L60", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L99", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L352", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/Order/functions.php#L858", "label": "security@wordfence.com" }, { "url": "https://github.com/getdokan/dokan/pull/3433/changes", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3734440/dokan-lite/trunk/includes/REST/CustomersController.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89280", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:42.851Z", "modifiedAt": "2026-10-16T15:17:33.920Z", "fetchedAt": "2026-10-23T02:43:51.996Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.", "sourceTitle": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "dokaninc", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "5.2.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-89280", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "fetchedAt": "2026-10-23T02:43:51.996Z", "publishedAt": "2026-10-16T03:38:42.851Z", "modifiedAt": "2026-10-16T15:09:40.901Z", "state": "published", "provider": "Wordfence", "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}", "descriptions": [ { "lang": "en", "value": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "dokaninc", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "5.2.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L227", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L60", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L99", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L352", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/Order/functions.php#L858", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/5" }, { "url": "https://github.com/getdokan/dokan/pull/3433/changes", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/6" }, { "url": "https://plugins.trac.wordpress.org/changeset/3734440/dokan-lite/trunk/includes/REST/CustomersController.php", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/7" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"dokaninc\",\"product\":\"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-639 Authorization Bypass Through User-Controlled Key\",\"cweId\":\"CWE-639\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T15:09:40.901Z", "fetchedAt": "2026-10-23T02:43:51.996Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T15:17:33.920Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsyに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:08.073Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ecf80e39867c879858d2a59634cf0d95335f0ee8a81fb2671247a3f59d49a321", "sourceModifiedAt": "2026-10-16T15:17:33.920Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution のバージョン5.2.1以下において、'password' パラメータの検証が欠如しているため、認証済みでカスタム+以上の権限を持つ攻撃者が /wp-json/dokan/v1/customers/{id} エンドポイントに対して任意の顧客のパスワードを変更できる。対象となる顧客は、攻撃者が運営するベンダーに対して少なくとも1件の注文を行っている必要がある。この操作により攻撃者はその顧客としてログインでき、限定的なアカウント乗っ取りが可能になる。", "risk": "攻撃者が顧客のパスワードを変更できるため、顧客としてログインでき、限定的なアカウント乗っ取りが起こる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグインは WordPress 用の Dokan: AI Powered WooCommerce Multivendor Marketplace Solution である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョンは 5.2.1 以下すべてが影響を受ける（5.2.1 を含む）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者は認証済みでカスタム+以上の権限（Custom+ 以上）を持っている必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ベンダーレベルのアクセスは、サイトで「I am a vendor」登録が有効になっている場合に公開登録フローから取得できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "被害者は、攻撃者のベンダーに対して少なくとも1件の注文を行った顧客である必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：dokaninc / Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy。影響ありとして記載：5.2.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-89280", "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=cve", "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L227", "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L60", "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L99", "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L352", "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/Order/functions.php#L858", "https://github.com/getdokan/dokan/pull/3433/changes", "https://plugins.trac.wordpress.org/changeset/3734440/dokan-lite/trunk/includes/REST/CustomersController.php", "https://nvd.nist.gov/vuln/detail/CVE-2026-89280" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89280", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L227", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L60", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L99", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/REST/CustomersController.php#L352", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/dokan-lite/tags/5.1.1/includes/Order/functions.php#L858", "label": "security@wordfence.com" }, { "url": "https://github.com/getdokan/dokan/pull/3433/changes", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset/3734440/dokan-lite/trunk/includes/REST/CustomersController.php", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89280", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "sourceField": "/containers/cna/title", "excerpt": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89280.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"dokaninc\",\"product\":\"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"5.2.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-89280（Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグインは WordPress 用の Dokan: AI Powered WooCommerce Multivendor Marketplace Solution である。\n・バージョンは 5.2.1 以下すべてが影響を受ける（5.2.1 を含む）。\n・攻撃者は認証済みでカスタム+以上の権限（Custom+ 以上）を持っている必要がある。\n・ベンダーレベルのアクセスは、サイトで「I am a vendor」登録が有効になっている場合に公開登録フローから取得できる。\n・被害者は、攻撃者のベンダーに対して少なくとも1件の注文を行った顧客である必要がある。\n・公式の対象表：dokaninc / Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy。影響ありとして記載：5.2.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-89280", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:08.073Z", "lastSuccess": "2026-10-23T03:21:08.073Z", "sourceCheckedAt": "2026-10-23T02:43:51.996Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-77829", "aliases": [], "title": "Cooked – Recipe Management：ブラウザー上での不正な処理", "summary": "Cooked – Recipe Management プラグインは、[cooked-timer] ショートコードのコンテンツに対する入力のサニタイズと出力エスケープが不十分なため、バージョン 1.16.1 までのすべてのバージョンで、認証済みの攻撃者（Contributor 以上の権限）が任意のウェブスクリプトをページに埋め込むことができ、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行されます。", "risk": "埋め込まれたスクリプトがページを表示した人のブラウザーで実行され、閲覧者のブラウザー上で不正な処理が行われる可能性があります。", "product": "Cooked – Recipe Management", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 6.4, "cvssVersion": "3.1", "cvssSource": "Wordfence", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Cooked – Recipe Management", "range": "<= 1.16.1" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-77829", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0592380d-fd78-48ed-a180-299fc20a41ee?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L159", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L155", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L128", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3729711%40cooked&new=3729711%40cooked", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77829", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-10-16T03:38:39.787Z", "modifiedAt": "2026-10-16T17:17:50.537Z", "fetchedAt": "2026-10-23T02:43:50.926Z", "exploitStatus": "unknown", "sources": [ "CVE", "NVD" ], "originalText": "The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "sourceTitle": "Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "goratech", "product": "Cooked – Recipe Management", "versions": [ { "version": "0", "status": "affected", "lessThanOrEqual": "1.16.1", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-77829", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "fetchedAt": "2026-10-23T02:43:50.926Z", "publishedAt": "2026-10-16T03:38:39.787Z", "modifiedAt": "2026-10-16T16:20:03.763Z", "state": "published", "provider": "Wordfence", "title": "Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content", "descriptions": [ { "lang": "en", "value": "The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "goratech", "product": "Cooked – Recipe Management", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "1.16.1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "provider": "Wordfence", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0592380d-fd78-48ed-a180-299fc20a41ee?source=cve", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/0" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L159", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/1" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L155", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/2" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L128", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/3" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3729711%40cooked&new=3729711%40cooked", "label": "Wordfence", "tags": [], "provider": "Wordfence", "sourcePath": "/containers/cna/references/4" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"goratech\",\"product\":\"Cooked – Recipe Management\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.16.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"cweId\":\"CWE-79\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":6.4,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-16T16:20:03.763Z", "fetchedAt": "2026-10-23T02:43:50.926Z", "state": "published" }, { "source": "NVD", "modifiedAt": "2026-10-16T17:17:50.537Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ], "sourceSummary": "Cooked – Recipe Managementにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:08.371Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "f9c78736fd4c2c6b4e3c5988b9bc6aa38fe1ce2be262eb2da31502a688922513", "sourceModifiedAt": "2026-10-16T17:17:50.537Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cooked – Recipe Management プラグインは、[cooked-timer] ショートコードのコンテンツに対する入力のサニタイズと出力エスケープが不十分なため、バージョン 1.16.1 までのすべてのバージョンで、認証済みの攻撃者（Contributor 以上の権限）が任意のウェブスクリプトをページに埋め込むことができ、ページを閲覧したユーザーのブラウザーでそのスクリプトが実行されます。", "risk": "埋め込まれたスクリプトがページを表示した人のブラウザーで実行され、閲覧者のブラウザー上で不正な処理が行われる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象プラグイン：Cooked – Recipe Management（WordPress 用）", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "影響を受けるバージョン：1.16.1 以下のすべてのバージョン", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "攻撃者の必要条件：認証済みで Contributor 以上の権限を持つユーザー", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "脆弱性の発生箇所：[cooked-timer] ショートコードのコンテンツ", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：goratech / Cooked – Recipe Management。影響ありとして記載：1.16.1以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面にログインし、「プラグイン」→「インストール済みプラグイン」を開きます。「Cooked – Recipe Management」と同じ製品名・開発元の項目を探し、表示されているバージョンを控えてください。停止中のプラグインも一覧に含めて確認します。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-77829", "https://www.wordfence.com/threat-intel/vulnerabilities/id/0592380d-fd78-48ed-a180-299fc20a41ee?source=cve", "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L159", "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L155", "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L128", "https://plugins.trac.wordpress.org/changeset?reponame=&old=3729711%40cooked&new=3729711%40cooked", "https://nvd.nist.gov/vuln/detail/CVE-2026-77829" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "label": "CVE：Wordfence" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-77829", "label": "CVE公式レコード" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0592380d-fd78-48ed-a180-299fc20a41ee?source=cve", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L159", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L155", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/browser/cooked/tags/1.16.0/includes/class.cooked-shortcodes.php#L128", "label": "security@wordfence.com" }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3729711%40cooked&new=3729711%40cooked", "label": "security@wordfence.com" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77829", "label": "NVDの原文" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "sourceField": "/containers/cna/title", "excerpt": "Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77829.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"goratech\",\"product\":\"Cooked – Recipe Management\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThanOrEqual\":\"1.16.1\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" } ], "supportRequest": "件名：CVE-2026-77829（Cooked – Recipe Management）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象プラグイン：Cooked – Recipe Management（WordPress 用）\n・影響を受けるバージョン：1.16.1 以下のすべてのバージョン\n・攻撃者の必要条件：認証済みで Contributor 以上の権限を持つユーザー\n・脆弱性の発生箇所：[cooked-timer] ショートコードのコンテンツ\n・公式の対象表：goratech / Cooked – Recipe Management。影響ありとして記載：1.16.1以下の版。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-77829", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:08.371Z", "lastSuccess": "2026-10-23T03:21:08.371Z", "sourceCheckedAt": "2026-10-23T02:43:50.926Z", "errorCode": null }, "glossary": [] } } ], "total": 2185, "limit": 20, "offset": 300, "filters": { "product": "all", "type": "all", "q": "", "page": 16 }, "pagination": { "page": 16, "pageSize": 20, "totalPages": 110 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 20, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T06:02:49.165Z 〜 2026-10-23T07:17:49.537Z、全製品の変更 31/31件まで確認、対象20件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T07:17:49.537Z", "lastAttempt": "2026-10-23T07:17:49.537Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }