CVE-2026-42648

## What is the vulnerability? CVE-2026-42648 is a missing authorization vulnerability in the Spectra plugin (ultimate-addons-for-gutenberg) for WordPress, affecting versions up to and including 2.19.22. The flaw stems from a broken access control issue, where the plugin fails to properly verify authorization, authentication, or nonce tokens in certain functions [1].

## How is it exploited? Attackers can exploit this vulnerability to perform actions that normally require higher privileges without proper authentication. This type of vulnerability is commonly used in mass-exploit campaigns targeting thousands of websites, regardless of their size or traffic [1].

Impact

Successful exploitation allows an unprivileged user to execute higher privileged actions, potentially leading to unauthorized modifications or access. While the severity is rated low (CVSS 4.3), the risk of widespread exploitation exists [1].

Mitigation

The vulnerability has been addressed in version 2.19.23. Users are strongly advised to update to this version or later. For Patchstack users, enabling auto-update for vulnerable plugins is recommended [1].