Live › vulnerability › CVE-2026-109592
The OpenStation WordPress plugin, through version 1.1.16, does not check authorization on some actions, so any logged-in user can change other users' placement rows. The same flaw lets them read titles, permalinks and post status of the items those placements reference.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the OpenStation plugin at version 1.1.16 or earlier, where people with accounts (including the default subscriber role) can log in. The exposure needs an orphaned placement, which the plugin's trash behaviour can create, and the attacker must first enable OpenStation through its save endpoint. Sites without the plugin, or with it removed, are not affected.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary other users' placement rows (position, sort order, parent folder, and meta) and read serialized metadata — including title, permalink, and post status — of the entities those orphaned placements reference. Exploitation requires at least one orphaned placement to exist — a state produced naturally by the plugin's own trash cascade, which marks a parent folder as trashed while leaving child placements' parent_id intact — and the attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability held by every default WordPress role. This was also independently found by the OpenStation team.
This page as .md · .json · in your agent: get_signal("CVE-2026-109592")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.