WordPress Plugin Vulnerabilities

Advanced Access Manager – Access Governance for WordPress < 7.1.1 - Missing Authorization

Description

The Advanced Access Manager – Access Governance for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.1.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
advanced-access-manager
Fixed in 7.1.1

References

CVE
CVE-2026-42674
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/15eaba51-e46f-4725-a6f9-7969bf00db5a

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Tiago Ventura (perses)
Verified
No
WPVDB ID
3d2ee208-cece-4968-8d27-a3e7bc0e04cb

Timeline

Publicly Published
2026-05-14 (about 1 month ago)
Added
2026-05-19 (about 1 month ago)
Last Updated
2026-05-19 (about 1 month ago)

Other

Published
Title
Published
2026-02-17
Title
PDF Invoices & Packing Slips for WooCommerce < 5.7.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
Published
2026-01-06
Title
iPaymu Payment Gateway for WooCommerce < 2.0.3 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure
Published
2025-05-22
Title
Booking and Rental Manager < 2.3.9 - Missing Authorization
Published
2025-12-16
Title
Converter for Media < 6.4.0 - Subscriber+ Optimized Image Deletion via regenerate-attachment REST Endpoint
Published
2024-03-26
Title
Colibri Page Builder < 1.0.249 - Missing Authorization