CVE-2026-5347

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5347", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-01T16:35:44.962Z", "datePublished": "2026-04-24T05:29:38.066Z", "dateUpdated": "2026-04-24T12:03:11.676Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-24T05:29:38.066Z"}, "affected": [{"vendor": "mhmrajib", "product": "WP Books Gallery \u2013 Build Stunning Book Showcases & Libraries in Minutes", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.8.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings."}], "title": "WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12bf1cd8-cd55-4771-b2bb-597797b1b949?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L207"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L207"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L206"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L206"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.8.1/wp-books-gallery.php#L207"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "timeline": [{"time": "2026-04-03T01:31:01.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-23T16:45:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T12:03:03.135179Z", "id": "CVE-2026-5347", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T12:03:11.676Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5347", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T12:03:03.135179Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T12:03:07.898Z"}}], "cna": {"title": "WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Abhirup Konwar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "mhmrajib", "product": "WP Books Gallery \u2013 Build Stunning Book Showcases & Libraries in Minutes", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.8.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-03T01:31:01.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-23T16:45:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12bf1cd8-cd55-4771-b2bb-597797b1b949?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L207"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L207"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L206"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L206"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.8.1/wp-books-gallery.php#L207"}], "descriptions": [{"lang": "en", "value": "The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-24T05:29:38.066Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5347", "state": "PUBLISHED", "dateUpdated": "2026-04-24T12:03:11.676Z", "dateReserved": "2026-04-01T16:35:44.962Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-24T05:29:38.066Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Books Gallery \u2013 Build Stunning Book Showcases & Libraries in Minutes", "vendor": "mhmrajib", "versions": [{"lessThanOrEqual": "4.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings."}], "id": "CVE-2026-5347", "lastModified": "2026-06-17T10:58:52.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5347", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T12:03:03.135179Z", "version": "2.0.3"}}]}, "published": "2026-04-24T06:16:04.913", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L206"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L207"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.8.1/wp-books-gallery.php#L207"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L206"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L207"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12bf1cd8-cd55-4771-b2bb-597797b1b949?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.8.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WP Books Gallery \u2013 Build Stunning Book Showcases & Libraries in Minutes", "source": "cna", "vendor": "mhmrajib"}, "product": "wp_books_gallery_\u2013_build_stunning_book_showcases_&_libraries_in_minutes", "vendor": "mhmrajib"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T20:24:35.938580+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Books Gallery plugin to version 4.8.1 or later.", "Configure a web application firewall or web\u2011server rule to deny unauthenticated POST requests to the plugin\u2019s settings endpoint, preventing the 'permalink_structure' parameter from being processed.", "If upgrading or firewall configuration is not possible, temporarily disable the plugin by renaming its folder or otherwise removing it from the plugins directory until the fix is applied."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Configuration Change"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in the WP Books Gallery plugin by mhmrajib, titled 'WP Books Gallery \u2013 Build Stunning Book Showcases & Libraries in Minutes'. Versions 4.0.0 through 4.8.0 inclusive are affected; any installations running those versions are at risk. Newer releases such as 4.8.1 contain the fix.", "description_and_impact": "The WP Books Gallery plugin for WordPress contains a missing authorization flaw in versions up to 4.8.0. The admin_init hook that processes permalink settings updates only checks for the presence of the 'permalink_structure' POST parameter and neglects to verify the caller's administrative capability or a valid nonce. As a result, an unauthenticated user can submit a POST request to the settings page and change the 'wbg_cpt_slug' option. Modifying this value alters the URL structure for all book entries, breaking existing links and hurting SEO, and undermines the integrity of the site's configuration.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only to craft an unauthenticated HTTP POST containing the 'permalink_structure' field and target the plugin\u2019s settings endpoint; no privileged access is required. The resulting impact could disrupt site navigation and degrade SEO, but it does not grant direct access to the underlying filesystem or data."}}}}, "created": "2026-04-28T09:18:08.551119+00:00", "updated": "2026-04-28T20:30:06.188983+00:00", "vendors": ["mhmrajib", "mhmrajib$PRODUCT$wp_books_gallery_\u2013_build_stunning_book_showcases_&_libraries_in_minutes", "wordpress", "wordpress$PRODUCT$wordpress"]}