CVE-2026-22479

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22479", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-07T13:44:16.751Z", "datePublished": "2026-03-05T05:53:47.776Z", "dateUpdated": "2026-04-28T17:18:53.507Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "easy-post-submission", "product": "Easy Post Submission", "vendor": "ThemeRuby", "versions": [{"changes": [{"at": "2.5.0", "status": "unaffected"}], "lessThanOrEqual": "2.4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Doan Dinh Van | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:19:18.600Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Easy Post Submission: from n/a through <= 2.4.0.</p>"}], "value": "Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.4.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:44.972Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/easy-post-submission/vulnerability/wordpress-easy-post-submission-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T14:42:38.477433Z", "id": "CVE-2026-22479", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T17:18:53.507Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T14:42:38.477433Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T14:42:14.636Z"}}], "cna": {"title": "WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Doan Dinh Van | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ThemeRuby", "product": "Easy Post Submission", "versions": [{"status": "affected", "changes": [{"at": "2.5.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.4.0"}], "packageName": "easy-post-submission", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:19:18.600Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/easy-post-submission/vulnerability/wordpress-easy-post-submission-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.4.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Easy Post Submission: from n/a through <= 2.4.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:44.972Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22479", "state": "PUBLISHED", "dateUpdated": "2026-04-28T17:18:53.507Z", "dateReserved": "2026-01-07T13:44:16.751Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-05T05:53:47.776Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "easy-post-submission", "product": "Easy Post Submission", "vendor": "ThemeRuby", "versions": [{"changes": [{"at": "2.5.0", "status": "unaffected"}], "lessThanOrEqual": "2.4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.4.0."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en ThemeRuby Easy Post Submission easy-post-submission permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Easy Post Submission: desde n/a hasta &lt;= 2.2.0."}], "id": "CVE-2026-22479", "lastModified": "2026-06-17T10:19:58.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22479", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T14:42:38.477433Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:21.690", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/easy-post-submission/vulnerability/wordpress-easy-post-submission-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Easy Post Submission", "source": "cna", "vendor": "ThemeRuby"}, "product": "easy_post_submission", "vendor": "themeruby"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T05:17:43.560695+00:00", "value": {"mitigation_remediation": ["Upgrade the Easy Post Submission plugin to the latest version (>=2.5) that contains the authorization fix.", "If an immediate upgrade is not possible, disable the plugin or restrict its accessibility so only administrators can use the submission form.", "Ensure that role\u2011based permissions are correctly configured, limiting the capability to submit posts to privileged users only."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized content posting"}, "threat_synthesis": {"affected_systems": "Applicable to all releases of ThemeRuby Easy Post Submission (Easy Post Submission) from the earliest available version up to and including 2.4.0; all environments running these versions are impacted.", "description_and_impact": "WordPress Easy Post Submission plugin versions up to and including 2.4.0 contain a missing authorization flaw that allows any visitor with access to the submission form to create posts without permission, potentially enabling spam, defacement, or deceptive content; the weakness maps to CWE\u2011862, indicating improper authorization checks.", "risk_and_exploitability": "With a CVSS score of 7.5, the vulnerability is considered high severity; however, the EPSS score is below 1%, indicating a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting content through the plugin\u2019s web interface without authentication, making the attack vector primarily web\u2011based and reliant on the lack of enforced access control."}}}}, "created": "2026-03-06T15:13:55.024902+00:00", "updated": "2026-04-16T05:30:25.785418+00:00", "vendors": ["themeruby", "themeruby$PRODUCT$easy_post_submission", "wordpress", "wordpress$PRODUCT$wordpress"]}