CVE-2026-1833

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1833", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T14:53:05.892Z", "datePublished": "2026-02-11T08:26:28.329Z", "dateUpdated": "2026-04-08T17:34:09.462Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:09.462Z"}, "affected": [{"vendor": "sm_rasmy", "product": "WaMate Confirm \u2013 Order Confirmation", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WaMate Confirm \u2013 Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators."}], "title": "WaMate Confirm <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9566fdd-c4ad-4971-b23b-bcf76c8b5cef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1579"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1596"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1579"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1596"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "timeline": [{"time": "2026-02-10T20:04:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:25:34.108080Z", "id": "CVE-2026-1833", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:25:42.232Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1833", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:25:34.108080Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:25:38.414Z"}}], "cna": {"title": "WaMate Confirm <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking", "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "sm_rasmy", "product": "WaMate Confirm \u2013 Order Confirmation", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-10T20:04:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9566fdd-c4ad-4971-b23b-bcf76c8b5cef?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1579"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1596"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1579"}, {"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1596"}], "descriptions": [{"lang": "en", "value": "The WaMate Confirm \u2013 Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:09.462Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1833", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:09.462Z", "dateReserved": "2026-02-03T14:53:05.892Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-11T08:26:28.329Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WaMate Confirm \u2013 Order Confirmation", "vendor": "sm_rasmy", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WaMate Confirm \u2013 Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators."}, {"lang": "es", "value": "El plugin WaMate Confirm \u2013 Order Confirmation para WordPress es vulnerable a acceso no autorizado en todas las versiones hasta la 2.0.1, inclusive. Esto se debe a que el plugin no verifica adecuadamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor o superior, bloqueen y desbloqueen n\u00fameros de tel\u00e9fono, lo cual deber\u00eda estar restringido a los administradores."}], "id": "CVE-2026-1833", "lastModified": "2026-06-17T10:16:35.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1833", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:25:34.108080Z", "version": "2.0.3"}}]}, "published": "2026-02-11T09:15:52.713", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1579"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1596"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1579"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1596"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9566fdd-c4ad-4971-b23b-bcf76c8b5cef?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.1]"}}], "product": "wamate_confirm_\u2013_order_confirmation", "vendor": "sm_rasmy"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:18:04.169461+00:00", "value": {"mitigation_remediation": ["Upgrade the WaMate Confirm \u2013 Order Confirmation plugin to the latest version that implements proper authorization checks.", "If an update is not immediately possible, restrict subscriber and lower role permissions so they cannot access the block/unblock functionality of the plugin.", "Continuously monitor user activity for unexpected changes to phone numbers and audit logs to detect unauthorized block or unblock actions."], "summary": {"action": "Update Plugin", "impact": "Unauthorized Modification of Phone Numbers"}, "threat_synthesis": {"affected_systems": "WordPress installations using the WaMate Confirm \u2013 Order Confirmation plugin, versions up to and including 2.0.1, distributed by sm_rasmy.", "description_and_impact": "The WaMate Confirm \u2013 Order Confirmation plugin for WordPress contains a missing authorization check that allows any authenticated user with subscriber-level or higher access to invoke functions for blocking and unblocking phone numbers. This flaw is a classic example of improper authorization (CWE\u2011862) and grants attackers the ability to alter contact information that should be restricted to administrators, potentially disrupting communications for the site\u2019s users or customers.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation in the wild. It is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated in the WordPress site, typically via a subscriber or higher role, and can be performed through the web interface or API endpoints provided by the plugin. The attack can iterate on the ability to block or unblock any phone number stored by the plugin, thereby affecting service availability and potentially enabling social engineering attacks."}}}}, "created": "2026-02-11T21:45:58.109849+00:00", "updated": "2026-04-15T17:30:10.484581+00:00", "vendors": ["sm_rasmy", "sm_rasmy$PRODUCT$wamate_confirm_\u2013_order_confirmation", "wordpress", "wordpress$PRODUCT$wordpress"]}