CVE-2026-23547

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23547", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-14T08:36:07.869Z", "datePublished": "2026-02-19T08:26:49.398Z", "dateUpdated": "2026-04-28T16:14:46.775Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "cmsmasters-content-composer", "product": "CMSMasters Content Composer", "vendor": "cmsmasters", "versions": [{"changes": [{"at": "2.5.9", "status": "unaffected"}], "lessThanOrEqual": "2.5.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:55.712Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8.</p>"}], "value": "Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:46.775Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/cmsmasters-content-composer/vulnerability/wordpress-cmsmasters-content-composer-plugin-2-5-8-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress CMSMasters Content Composer plugin <= 2.5.8 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T17:08:47.232239Z", "id": "CVE-2026-23547", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T15:43:35.348Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23547", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T17:08:47.232239Z"}}}, {"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T17:07:22.932Z"}}], "cna": {"title": "WordPress CMSMasters Content Composer plugin <= 2.5.8 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "cmsmasters", "product": "CMSMasters Content Composer", "versions": [{"status": "affected", "changes": [{"at": "2.5.9", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.5.8"}], "packageName": "cmsmasters-content-composer", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:04:55.712Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/cmsmasters-content-composer/vulnerability/wordpress-cmsmasters-content-composer-plugin-2-5-8-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:46.775Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23547", "state": "PUBLISHED", "dateUpdated": "2026-04-28T16:14:46.775Z", "dateReserved": "2026-01-14T08:36:07.869Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:26:49.398Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "cmsmasters-content-composer", "product": "CMSMasters Content Composer", "vendor": "cmsmasters", "versions": [{"changes": [{"at": "2.5.9", "status": "unaffected"}], "lessThanOrEqual": "2.5.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8."}, {"lang": "es", "value": "Vulnerabilidad de Autorizaci\u00f3n Faltante en cmsmasters CMSMasters Content Composer cmsmasters-content-composer permite Explotar Niveles de Seguridad de Control de Acceso Incorrectamente Configurados. Este problema afecta a CMSMasters Content Composer: desde n/a hasta &lt;= 2.5.8."}], "id": "CVE-2026-23547", "lastModified": "2026-06-17T10:21:45.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23547", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T17:08:47.232239Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:12.627", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/cmsmasters-content-composer/vulnerability/wordpress-cmsmasters-content-composer-plugin-2-5-8-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.8]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.5.9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "CMSMasters Content Composer", "source": "cna", "vendor": "cmsmasters"}, "product": "cmsmasters_content_composer", "vendor": "cmsmasters"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:41:20.797129+00:00", "value": {"mitigation_remediation": ["Upgrade CMSMasters Content Composer to a version newer than 2.5.8 or apply the vendor's fix if available", "If an upgrade is not immediately possible, restrict access to the composer administration pages using WordPress role capabilities or server\u2011level access controls to ensure only authorized users can reach the affected functionality", "Verify that all composer features are properly protected by authentication checks by reviewing the plugin\u2019s access control logic and confirming that only users with the required capabilities can invoke them"], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access to Composer Functions"}, "threat_synthesis": {"affected_systems": "The flaw affects the CMSMasters Content Composer plugin for WordPress on all versions from not applicable through version 2.5.8. Users of WordPress sites that have not upgraded the plugin beyond this version are vulnerable.", "description_and_impact": "A missing authorization check in the CMSMasters Content Composer WordPress plugin allows attackers who can access the administration interface to perform actions that should be restricted to privileged users. The vulnerability is caused by an incorrectly configured access control security level, enabling users without proper permissions to manipulate content composer functionality and potentially alter site content or settings.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.1, indicating a high impact if exploited, while the EPSS score is less than 1% suggesting a low probability of exploitation at this time. It is not included in the CISA Known Exploited Vulnerabilities list, reducing the likelihood of a widespread targeted attack. The attack vector is most likely through the web interface; attackers need to authenticate to the WordPress admin area or leverage another authenticated session to access the vulnerable composer endpoints. The weakness is classified as CWE\u2011862, a missing authorization flaw."}}}}, "created": "2026-02-20T10:11:18.730936+00:00", "updated": "2026-04-16T06:45:16.318030+00:00", "vendors": ["cmsmasters", "cmsmasters$PRODUCT$cmsmasters_content_composer", "wordpress", "wordpress$PRODUCT$wordpress"]}