CVE-2026-23804

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23804", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-16T14:15:17.505Z", "datePublished": "2026-02-19T08:26:50.356Z", "dateUpdated": "2026-04-28T16:14:47.286Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "better-business-reviews", "product": "Better Business Reviews", "vendor": "BBR Plugins", "versions": [{"changes": [{"at": "0.1.2", "status": "unaffected"}], "lessThanOrEqual": "0.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:11.019Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Better Business Reviews: from n/a through <= 0.1.1.</p>"}], "value": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:47.286Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/better-business-reviews/vulnerability/wordpress-better-business-reviews-plugin-0-1-1-broken-access-control-vulnerability-2?_s_id=cve"}], "title": "WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:20:49.887457Z", "id": "CVE-2026-23804", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T15:44:46.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23804", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T21:20:49.887457Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:20:11.516Z"}}], "cna": {"title": "WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BBR Plugins", "product": "Better Business Reviews", "versions": [{"status": "affected", "changes": [{"at": "0.1.2", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "0.1.1"}], "packageName": "better-business-reviews", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:14.064Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/better-business-reviews/vulnerability/wordpress-better-business-reviews-plugin-0-1-1-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Better Business Reviews: from n/a through <= 0.1.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:44.575Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23804", "state": "PUBLISHED", "dateUpdated": "2026-04-28T15:44:46.325Z", "dateReserved": "2026-01-16T14:15:17.505Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:26:50.356Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "better-business-reviews", "product": "Better Business Reviews", "vendor": "BBR Plugins", "versions": [{"changes": [{"at": "0.1.2", "status": "unaffected"}], "lessThanOrEqual": "0.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1."}, {"lang": "es", "value": "Vulnerabilidad de falta de autorizaci\u00f3n en BBR Plugins Better Business Reviews better-business-reviews permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Better Business Reviews: desde n/a hasta &lt;= 0.1.1."}], "id": "CVE-2026-23804", "lastModified": "2026-06-17T10:22:07.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23804", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:20:49.887457Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:13.217", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/better-business-reviews/vulnerability/wordpress-better-business-reviews-plugin-0-1-1-broken-access-control-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,0.1.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.1.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Better Business Reviews", "source": "cna", "vendor": "BBR Plugins"}, "product": "better_business_reviews", "vendor": "bbr_plugins"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:40:23.630813+00:00", "value": {"mitigation_remediation": ["Upgrade the Better Business Reviews plugin to version 0.1.2 or later.", "If the update is not yet available, remove or disable the plugin entirely from the site.", "As an interim measure, restrict access to the plugin\u2019s administrative URLs using a web\u2011server rule (e.g., .htaccess) or a security plugin that limits access to collaborators only."], "summary": {"action": "Immediate patch", "impact": "Unauthorized access to Better Business Reviews features"}, "threat_synthesis": {"affected_systems": "All installations of BBR Plugins Better Business Reviews up to and including version 0.1.1 are vulnerable. The issue applies to every site that has deployed this plugin version, without regard to additional configuration or external controls.", "description_and_impact": "The vulnerability is a missing authorization flaw that allows an attacker to access and manipulate the Better Business Reviews plugin without proper permissions. This was identified as CWE\u2011862, indicating a lack of access control checks. An attacker who reaches the affected functionality could read, edit, or delete review data, potentially compromising the integrity and confidentiality of business review information stored in the WordPress database.", "risk_and_exploitability": "The CVSS score of 5.4 places the issue in the medium severity range, and the EPSS score of less than 1% suggests that widespread exploitation is currently uncommon. Because the vulnerability is accessed via the plugin\u2019s web interface, any publicly reachable WordPress site that has not been patched can be exploited by an unauthenticated actor. The plugin\u2019s functionality is not restricted by any external authentication layer, so the attack surface is relatively high. Even though the exploit probability is low, the potential impact to business review data warrants prompt attention."}}}}, "created": "2026-02-20T10:11:15.303647+00:00", "updated": "2026-04-16T06:45:16.317009+00:00", "vendors": ["bbr_plugins", "bbr_plugins$PRODUCT$better_business_reviews", "wordpress", "wordpress$PRODUCT$wordpress"]}