CVE-2026-24534CWE-862

WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability

Medium · published January 23, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

⚠️ A missing authorization check in uPress Booter's crawlers-manager could let intruders slip through the cracks of your security! Think of this like a restaurant that forgets to check reservations at the entrance; anyone can waltz in and take a seat, regardless of whether they have a table or not! This vulnerability allows unauthorized users to access restricted features, potentially letting them manipulate settings or gather sensitive information without permission. This could lead to unwanted changes that disrupt your operations or expose your data. It's a medium risk, but still something you don’t want lingering!

Put simply

Think of this like a restaurant that forgets to check reservations at the entrance; anyone can waltz in and take a seat, regardless of whether they have a table or not! The missing authorization flaw in uPress Booter's booter-bots-crawlers-manager means users can exploit incorrectly configured access control security levels, allowing access without proper checks.

What to do

This vulnerability allows unauthorized users to access restricted features, potentially letting them manipulate settings or gather sensitive information without permission. This could lead to unwanted changes that disrupt your operations or expose your data. It's a medium risk, but still something you don’t want lingering! To protect your system, update uPress Booter to version 1.5.8 or later right away. Review your access control settings to ensure they are configured correctly, and consider implementing stricter checks to prevent unauthorized access in the future. You've got this! Stay vigilant and follow these steps to safeguard your system! 🛡️

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-23T14:28Z
EPSS history
Timeline
  • 23 JAN 14:28Z
    WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability
    cvelistv5