WordPress Plugin Vulnerabilities

OwnerRez < 1.3.0 - Missing Authorization

Description

The OwnerRez plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.2.6. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
ownerrez
Fixed in 1.3.0

References

CVE
CVE-2026-81758
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0c5e3ca4-fbba-4428-ab3b-e955aa9f60d4

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
JunHee CHO
Verified
No
WPVDB ID
a69a5f75-e78d-4441-898b-a7828784de5e

Timeline

Publicly Published
2026-08-28 (about 24 days ago)
Added
2026-09-01 (about 19 days ago)
Last Updated
2026-09-01 (about 19 days ago)

Other

Published
Title
Published
2024-05-15
Title
weMail < 1.14.3 - Missing Authorization to Notice Dismissal
Published
2025-01-08
Title
SKT Page Builder < 4.8 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2025-05-01
Title
Flynax Bridge < 2.2.1 - Unauthenticated Limited Privilege Escalation
Published
2021-11-08
Title
Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal
Published
2025-06-05
Title
ThemeHunk <= 1.1.2- Missing Authorization