CVE-2026-24563

Vulnerability

Overview CVE-2026-24563 is a missing authorization vulnerability in the LifePress plugin for WordPress, affecting versions from n/a through 2.2.1. The issue stems from incorrectly configured access control security levels, which can be exploited by unauthenticated attackers to perform actions that should require higher privileges [1].

Exploitation

Attackers can exploit this vulnerability without authentication by sending crafted requests to the vulnerable plugin endpoints. The attack surface is broad because the plugin is widely used, and the vulnerability can be leveraged in mass-exploit campaigns targeting thousands of websites regardless of their size or popularity [1].

Impact

Successful exploitation allows an attacker to bypass access controls and execute unauthorized actions, potentially leading to data exposure, privilege escalation, or other malicious activities depending on the specific functions affected. The CVSS v3 base score is 4.3 (Medium), indicating a moderate severity [1].

Mitigation

The vulnerability has been addressed in version 2.2.2 of the LifePress plugin. Users are strongly advised to update to this version or later. For those unable to update immediately, consulting a hosting provider or web developer is recommended. Patchstack users can enable auto-updates for vulnerable plugins [1].