CVE-2026-34903

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34903", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-31T09:57:35.161Z", "datePublished": "2026-04-07T08:57:51.189Z", "dateUpdated": "2026-04-07T12:59:24.495Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-07T08:57:51.189Z"}, "title": "WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "OceanWP", "product": "Ocean Extra", "collectionURL": "https://wordpress.org/plugins", "packageName": "ocean-extra", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "2.5.3", "changes": [{"at": "2.5.4", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ocean Extra: from n/a through 2.5.3.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/ocean-extra/vulnerability/wordpress-ocean-extra-plugin-2-5-3-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "Update the WordPress Ocean Extra Plugin to the latest available version (at least 2.5.4).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress Ocean Extra Plugin to the latest available version (at least 2.5.4)."}]}], "credits": [{"lang": "en", "value": "Nguyen Ba Khanh | Patchstack Bug Bounty Program", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T12:56:36.229171Z", "id": "CVE-2026-34903", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T12:59:24.495Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34903", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T12:56:36.229171Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T12:57:52.716Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Nguyen Ba Khanh | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OceanWP", "product": "Ocean Extra", "versions": [{"status": "affected", "changes": [{"at": "2.5.4", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "2.5.3"}], "packageName": "ocean-extra", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Ocean Extra Plugin to the latest available version (at least 2.5.4).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Ocean Extra Plugin to the latest available version (at least 2.5.4).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/ocean-extra/vulnerability/wordpress-ocean-extra-plugin-2-5-3-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ocean Extra: from n/a through 2.5.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-07T08:57:51.189Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34903", "state": "PUBLISHED", "dateUpdated": "2026-04-07T12:59:24.495Z", "dateReserved": "2026-03-31T09:57:35.161Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-07T08:57:51.189Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ocean-extra", "product": "Ocean Extra", "vendor": "OceanWP", "versions": [{"changes": [{"at": "2.5.4", "status": "unaffected"}], "lessThanOrEqual": "2.5.3", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en OceanWP Ocean Extra permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Ocean Extra: desde n/a hasta 2.5.3."}], "id": "CVE-2026-34903", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34903", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T12:56:36.229171Z", "version": "2.0.3"}}]}, "published": "2026-04-07T09:16:21.520", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/ocean-extra/vulnerability/wordpress-ocean-extra-plugin-2-5-3-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Ocean Extra", "source": "cna", "vendor": "OceanWP"}, "product": "ocean_extra", "vendor": "oceanwp"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-07T10:20:15.364279+00:00", "value": {"mitigation_remediation": ["Update the Ocean Extra plugin to version 2.5.4 or newer.", "If the plugin is not required, remove it from the WordPress installation.", "After updating, review and confirm that the administrative pages of the plugin are only accessible by the intended user roles.", "Periodically audit plugin settings and WordPress user roles to ensure no unauthorized access permissions exist."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access due to broken access control"}, "threat_synthesis": {"affected_systems": "The problem affects Ocean Extra plugin versions up to and including 2.5.3. WordPress sites that have installed Ocean Extra within this version range are susceptible. The precise scope is limited to sites running WordPress with the plugin present, but because the plugin interfaces with the site\u2019s core administrative functions, the compromise can reach the entire site. Any user who can authenticate to the site with a role that receives permission to use the plugin could potentially exploit the flaw.", "description_and_impact": "Ocean Extra, a WordPress plugin by OceanWP, has a missing authorization check that allows attackers to exploit incorrectly configured access control levels. The vulnerability is classified as CWE-862 \u2013 Missing Authorization. If an attacker obtains this flaw, they could gain privileged operations within the plugin\u2019s administrative interface, potentially accessing or modifying sensitive site data and configuration settings. The impact is the accidental or malicious escalation of privileges to a level that is normally restricted to site administrators or trusted users.", "risk_and_exploitability": "The CVSS score for this vulnerability is 5.4, indicating a medium severity. There is no EPSS data available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an authenticated attacker navigating the plugin\u2019s UI, where the missing authorization allows bypassing role-based restrictions. Because the vulnerability hinges on a configuration oversight rather than a network-facing flaw, the risk profile is primarily internal, but any compromised credentials or social engineering that yields a legitimate WordPress login can lead to exploitation. Site owners should treat the risk as moderate and mitigate promptly."}}}}, "created": "2026-04-08T19:38:30.151069+00:00", "updated": "2026-04-08T19:49:50.137305+00:00", "vendors": ["oceanwp", "oceanwp$PRODUCT$ocean_extra", "wordpress", "wordpress$PRODUCT$wordpress"]}