CVE-2026-24633

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24633", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:36.811Z", "datePublished": "2026-01-23T14:29:08.810Z", "dateUpdated": "2026-04-28T16:14:51.181Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "add-expires-headers", "product": "Add Expires Headers & Optimized Minify", "vendor": "Passionate Brains", "versions": [{"changes": [{"at": "3.3.0", "status": "unaffected"}], "lessThanOrEqual": "3.2.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:50.348Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0.</p>"}], "value": "Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:51.181Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/add-expires-headers/vulnerability/wordpress-add-expires-headers-optimized-minify-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T16:59:38.921311Z", "id": "CVE-2026-24633", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:44:43.842Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24633", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T16:59:38.921311Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T16:59:34.301Z"}}], "cna": {"title": "WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Passionate Brains", "product": "Add Expires Headers & Optimized Minify", "versions": [{"status": "affected", "changes": [{"at": "3.3.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.2.0"}], "packageName": "add-expires-headers", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:50.348Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/add-expires-headers/vulnerability/wordpress-add-expires-headers-optimized-minify-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:07.131Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24633", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:44:43.842Z", "dateReserved": "2026-01-23T12:32:36.811Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:29:08.810Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "add-expires-headers", "product": "Add Expires Headers & Optimized Minify", "vendor": "Passionate Brains", "versions": [{"changes": [{"at": "3.3.0", "status": "unaffected"}], "lessThanOrEqual": "3.2.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0."}, {"lang": "es", "value": "Vulnerabilidad por autorizaci\u00f3n faltante en Passionate Brains Add Expires Headers &amp; Optimized Minify add-expires-headers permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Add Expires Headers &amp; Optimized Minify: desde n/a hasta &lt;= 3.1.0."}], "id": "CVE-2026-24633", "lastModified": "2026-06-17T10:23:21.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24633", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T16:59:38.921311Z", "version": "2.0.3"}}]}, "published": "2026-01-23T15:16:22.970", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/add-expires-headers/vulnerability/wordpress-add-expires-headers-optimized-minify-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T22:28:17.634688+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to the latest available version, which includes the authorization fix.", "If an upgrade cannot be applied immediately, temporarily disable the Minify and Expires Headers functionality or deactivate the plugin until the patch is installed.", "Restrict administrator access to the WordPress back\u2011end to trusted users only and monitor logs for unexpected plugin activity to confirm the vulnerability has been mitigated."], "summary": {"action": "Patch", "impact": "Unauthorized Access to Plugin Settings"}, "threat_synthesis": {"affected_systems": "WordPress installations that have the Passionate Brains Add Expires Headers & Optimized Minify plugin installed with a version number 3.2.0 or earlier. All sites running these versions without the patch are vulnerable.", "description_and_impact": "The vulnerability is a missing authorization flaw in the Passionate Brains Add Expires Headers & Optimized Minify WordPress plugin, which permits attackers to invoke restricted endpoints without the proper access checks. By exploiting the incorrect configuration of access control security levels, an attacker can access or modify plugin settings and configuration data, potentially leading to configuration tampering or disclosure of sensitive information. This broken access control weakness is identified as CWE\u2011862.", "risk_and_exploitability": "The CVSS score of 5.3 describes moderate severity, and the EPSS score is under 1%, indicating a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw permits unrestricted access to privileged plugin functions, any user who can invoke the affected endpoint could read or alter data. The advisory recommends updating to the latest plugin release; no public workaround is available."}}}}, "created": "2026-01-26T11:53:33.714453+00:00", "updated": "2026-04-28T22:30:41.637913+00:00", "vendors": ["passionatebrains", "passionatebrains$PRODUCT$add_expires_headers_\\&_optimized_minify", "wordpress", "wordpress$PRODUCT$wordpress"]}