CVE-2026-40742

Vulnerability

Overview The Nelio AB Testing plugin for WordPress (versions up to and including 8.2.8) contains a Missing Authorization vulnerability [1]. This flaw stems from incorrectly configured access control security levels, which can be exploited to bypass authorization checks.

Exploitation

Details An attacker can exploit this vulnerability without authentication, by sending crafted requests to the affected plugin endpoints. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it easy for attackers to trigger the issue remotely [1].

Impact

Successful exploitation allows an attacker to view sensitive information that is normally restricted to authorized users. This sensitive data exposure can be leveraged to further compromise the WordPress site or its users, potentially leading to more severe attacks [1].

Mitigation

The vendor has released updates to address this issue. Users are strongly advised to update the Nelio AB Testing plugin to version 8.2.9 or later. If immediate update is not possible, consider implementing a Web Application Firewall (WAF) or temporarily disabling the plugin until the patch can be applied [1].