CVE-2026-23545

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23545", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-14T08:36:07.869Z", "datePublished": "2026-02-19T08:26:49.211Z", "dateUpdated": "2026-04-28T16:14:46.767Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "aruba-hispeed-cache", "product": "Aruba HiSpeed Cache", "vendor": "Aruba.it Dev", "versions": [{"changes": [{"at": "3.0.5", "status": "unaffected"}], "lessThanOrEqual": "3.0.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "NumeX | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:54.176Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Aruba HiSpeed Cache: from n/a through <= 3.0.4.</p>"}], "value": "Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through <= 3.0.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:46.767Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/aruba-hispeed-cache/vulnerability/wordpress-aruba-hispeed-cache-plugin-3-0-4-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Aruba HiSpeed Cache plugin <= 3.0.4 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T18:52:32.380909Z", "id": "CVE-2026-23545", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T15:43:14.476Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23545", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T18:52:32.380909Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T18:52:45.648Z"}}], "cna": {"title": "WordPress Aruba HiSpeed Cache plugin <= 3.0.4 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "NumeX | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Aruba.it Dev", "product": "Aruba HiSpeed Cache", "versions": [{"status": "affected", "changes": [{"at": "3.0.5", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.0.4"}], "packageName": "aruba-hispeed-cache", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:14.289Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/aruba-hispeed-cache/vulnerability/wordpress-aruba-hispeed-cache-plugin-3-0-4-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through <= 3.0.4.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Aruba HiSpeed Cache: from n/a through <= 3.0.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:44.358Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23545", "state": "PUBLISHED", "dateUpdated": "2026-04-28T15:43:14.476Z", "dateReserved": "2026-01-14T08:36:07.869Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:26:49.211Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "aruba-hispeed-cache", "product": "Aruba HiSpeed Cache", "vendor": "Aruba.it Dev", "versions": [{"changes": [{"at": "3.0.5", "status": "unaffected"}], "lessThanOrEqual": "3.0.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through <= 3.0.4."}, {"lang": "es", "value": "Vulnerabilidad de Autorizaci\u00f3n Faltante en Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache permite la Explotaci\u00f3n de Niveles de Seguridad de Control de Acceso Incorrectamente Configurados. Este problema afecta a Aruba HiSpeed Cache: desde n/a hasta &lt;= 3.0.4."}], "id": "CVE-2026-23545", "lastModified": "2026-06-17T10:21:45.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23545", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T18:52:32.380909Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:12.480", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/aruba-hispeed-cache/vulnerability/wordpress-aruba-hispeed-cache-plugin-3-0-4-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.0.5,*]"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "Aruba HiSpeed Cache", "source": "cna", "vendor": "Aruba.it Dev"}, "product": "aruba_hispeed_cache", "vendor": "arubadev"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:41:37.174796+00:00", "value": {"mitigation_remediation": ["Upgrade Aruba HiSpeed Cache to version 3.0.5 or newer.", "If an upgrade is not immediately possible, remove or deactivate the plugin to eliminate the attack surface.", "Restrict direct access to the plugin\u2019s administrative routes by configuring web server rules or disabling unused endpoints."], "summary": {"action": "Immediate Patch", "impact": "Escalation of Privileges within WordPress sites"}, "threat_synthesis": {"affected_systems": "WordPress installations running Aruba.it Dev Aruba HiSpeed Cache version 3.0.4 or earlier are affected. The vulnerability is present in any installation of the plugin where the default or custom access control settings have been incorrectly configured or left unchanged.", "description_and_impact": "The Aruba HiSpeed Cache plugin suffers from a missing authorization flaw that enables an attacker to bypass the plugin\u2019s access control and invoke privileged operations beyond their intended role. This flaw aligns with the CWE-862 \"Missing Authorization\" weakness, leading to the potential compromise of site configuration, content, or administrative functions.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.5, indicating a moderate impact. The EPSS score is lower than 1%, suggesting a low probability of exploitation in the wild; it is not listed in the CISA KEV catalog. However, if a public WordPress site deploys a vulnerable plugin version, attackers can remotely submit crafted requests to the plugin\u2019s endpoints to elevate privileges and take full control of the site, especially if the plugin is exposed through a standard URL pattern."}}}}, "created": "2026-02-20T10:11:19.671332+00:00", "updated": "2026-04-16T06:45:16.318548+00:00", "vendors": ["arubadev", "arubadev$PRODUCT$aruba_hispeed_cache", "wordpress", "wordpress$PRODUCT$wordpress"]}