{"id":"CVE-2026-109592","kind":"vulnerability","aliases":["CVE-2026-109592"],"related":[],"title":"OpenStation WordPress plugin: subscribers can alter other users' desktop placements","description":"The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary other users' placement rows (position, sort order, parent folder, and meta) and read serialized metadata — including title, permalink, and post status — of the entities those orphaned placements reference. Exploitation requires at least one orphaned placement to exist — a state produced naturally by the plugin's own trash cascade, which marks a parent folder as trashed while leaving child placements' parent_id intact — and the attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability held by every default WordPress role. This was also independently found by the OpenStation team.","summary":"The OpenStation WordPress plugin, through version 1.1.16, does not check authorization on some actions, so any logged-in user can change other users' placement rows. The same flaw lets them read titles, permalinks and post status of the items those placements reference.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openstation","package","wordpress","wordpress-plugin"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources do not name a file or setting to check.\n- Confirm whether the OpenStation plugin is installed at all and whether any user can log in with the subscriber role.","fix":null,"status":"open","published_at":"2026-10-30T18:17:19+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","triaged_at":"2026-10-30T18:57:15+00:00","updated_at":"2026-10-30T18:57:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:57:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenStation WordPress plugin: subscribers can alter other users' desktop placements","impact":"low","summary":"The OpenStation WordPress plugin, through version 1.1.16, does not check authorization on some actions, so any logged-in user can change other users' placement rows. The same flaw lets them read titles, permalinks and post status of the items those placements reference.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","openstation"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"logged-in users read and alter other users' desktop placements","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources do not name a file or setting to check.\n- Confirm whether the OpenStation plugin is installed at all and whether any user can log in with the subscriber role.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Sites running the OpenStation plugin at version 1.1.16 or earlier, where people with accounts (including the default subscriber role) can log in. The exposure needs an orphaned placement, which the plugin's trash behaviour can create, and the attacker must first enable OpenStation through its save endpoint. Sites without the plugin, or with it removed, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4361,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109592':13A,16A '-2026':12A,15A '1.1.16':29B,91C 'access':121C 'action':36B,109C 'admin':75C 'ajax':203C 'also':219C 'alter':6A 'arbitrari':126C 'attack':116C,191C 'authent':115C 'author':33B,82C,105C 'bypass':83C 'capabl':210C 'cascad':174C 'chang':44B 'check':32B 'child':184C 'cve':11A,14A 'default':214C 'desktop':9A,68C,72C 'dock':70C 'due':94C 'enabl':196C 'endpoint':204C 'entiti':150C 'everi':213C 'exist':163C 'exploit':155C 'first':193C 'flaw':51B 'folder':135C,179C 'found':221C 'held':211C 'id':187C 'includ':90C,142C 'independ':220C 'intact':188C 'item':62B 'least':158C 'leav':183C 'let':52B 'level':120C 'log':40B 'logged-in':39B 'make':111C 'mark':176C 'meta':137C 'metadata':141C 'modifi':125C 'must':192C 'natur':167C 'one':159C 'openst':1A,17B,24B,67C,197C,202C,224C 'order':133C 'orphan':152C,160C 'packag':18B 'parent':134C,178C,186C 'perform':107C 'permalink':56B,144C 'placement':10A,47B,64B,129C,153C,161C,185C 'plugin':3A,22B,26B,76C,97C,170C 'posit':131C 'possibl':113C 'post':58B,146C 'produc':166C 'proper':99C 'read':54B,139C,209C 'refer':65B,154C 'requir':156C,206C 'role':216C 'row':48B,130C 'save':201C 'save-openst':200C 'self':195C 'self-en':194C 'serial':140C 'sort':132C 'state':165C 'status':59B,147C 'subscrib':4A,119C 'subscriber-level':118C 'team':225C 'titl':55B,143C 'trash':173C,181C 'user':8A,42B,46B,103C,128C 'verifi':100C 'version':28B,86C 'via':198C 'virtual':71C 'vulner':80C 'window':69C 'wordpress':2A,19B,21B,25B,78C,215C 'wordpress-plugin':20B 'wp':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the OpenStation plugin at version 1.1.16 or earlier, where people with accounts (including the default subscriber role) can log in. The exposure needs an orphaned placement, which the plugin's trash behaviour can create, and the attacker must first enable OpenStation through its save endpoint. Sites without the plugin, or with it removed, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109592","severity":null,"published_at":"2026-10-30T18:17:19+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","fetched_at":"2026-10-30T18:55:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}