CVE-2026-28038

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28038", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-25T12:13:25.489Z", "datePublished": "2026-03-05T05:54:14.595Z", "dateUpdated": "2026-04-28T17:32:37.827Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ultimate_vc_addons", "product": "Ultimate Addons for WPBakery Page Builder", "vendor": "Brainstorm_Force", "versions": [{"changes": [{"at": "3.21.2", "status": "unaffected"}], "lessThanOrEqual": "3.21.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jo\u00e3o Pedro S Alc\u00e2ntara (Kinorth) | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:19:18.865Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1.</p>"}], "value": "Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:05.116Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T20:47:42.720920Z", "id": "CVE-2026-28038", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T17:32:37.827Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T20:47:42.720920Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T20:47:00.425Z"}}], "cna": {"title": "WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Jo\u00e3o Pedro S Alc\u00e2ntara (Kinorth) | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Brainstorm_Force", "product": "Ultimate Addons for WPBakery Page Builder", "versions": [{"status": "affected", "changes": [{"at": "3.21.2", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.21.1"}], "packageName": "ultimate_vc_addons", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:19:18.865Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:05.116Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28038", "state": "PUBLISHED", "dateUpdated": "2026-04-28T17:32:37.827Z", "dateReserved": "2026-02-25T12:13:25.489Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-05T05:54:14.595Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ultimate_vc_addons", "product": "Ultimate Addons for WPBakery Page Builder", "vendor": "Brainstorm_Force", "versions": [{"changes": [{"at": "3.21.2", "status": "unaffected"}], "lessThanOrEqual": "3.21.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons permite Explotar Niveles de Seguridad de Control de Acceso Configurados Incorrectamente. Este problema afecta a Ultimate Addons for WPBakery Page Builder: desde n/a hasta &lt;= 3.21.1."}], "id": "CVE-2026-28038", "lastModified": "2026-06-17T10:28:08.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28038", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T20:47:42.720920Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:36.753", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.21.1]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Ultimate Addons for WPBakery Page Builder", "source": "cna", "vendor": "Brainstorm_Force"}, "product": "ultimate_addons_for_wpbakery_page_builder", "vendor": "brainstormforce"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T17:30:18.603855+00:00", "value": {"mitigation_remediation": ["Upgrade the WordPress Ultimate Addons for WPBakery Page Builder plugin to version 3.21.2 or later", "Ensure that the plugin\u2019s administrative capabilities are restricted to users with Administrator roles and disable any generic or low\u2011privilege roles that can access the plugin configuration", "If the patch cannot be applied immediately, temporarily deactivate the plugin or replace it with a less privileged alternative until the issue is resolved"], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access and potential privilege escalation"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress Ultimate Addons for WPBakery Page Builder plugin from Brainstorm Force. Versions up to and including 3.21.1 are impacted. Versions 3.21.2 and later are not vulnerable.", "description_and_impact": "The vulnerability is a broken access control flaw that allows an attacker to bypass incorrectly configured security levels. It could enable users without proper authorization to perform actions reserved for privileged users, potentially exposing or modifying sensitive data or configuration settings. The weakness is classified as CWE\u2011862, indicating improper authorization enforcement.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. EPSS is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, implying no known exploitation in the wild. The likely attack vector is web-based due to the plugin operating within a WordPress installation; however, the exact delivery method is not specified in the description."}}}}, "created": "2026-03-06T15:11:16.308177+00:00", "updated": "2026-04-28T17:45:16.110238+00:00", "vendors": ["brainstormforce", "brainstormforce$PRODUCT$ultimate_addons_for_wpbakery_page_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}