---
id: "CVE-2026-109592"
kind: "vulnerability"
aliases: ["CVE-2026-109592"]
title: "OpenStation WordPress plugin: subscribers can alter other users' desktop placements"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["openstation", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-subscriber-accounts", "plugin-not-installed"]
published_at: "2026-10-30T18:17:19+00:00"
first_seen_at: "2026-10-30T18:55:28+00:00"
updated_at: "2026-10-30T18:57:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109592", "first_seen_at": "2026-10-30T18:55:28+00:00"}]
---

# OpenStation WordPress plugin: subscribers can alter other users' desktop placements

The OpenStation WordPress plugin, through version 1.1.16, does not check authorization on some actions, so any logged-in user can change other users' placement rows. The same flaw lets them read titles, permalinks and post status of the items those placements reference.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; the sources do not name a file or setting to check.
- Confirm whether the OpenStation plugin is installed at all and whether any user can log in with the subscriber role.

## Timeline

- 2026-10-30T18:55:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109592

## From the sources

The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary other users' placement rows (position, sort order, parent folder, and meta) and read serialized metadata — including title, permalink, and post status — of the entities those orphaned placements reference. Exploitation requires at least one orphaned placement to exist — a state produced naturally by the plugin's own trash cascade, which marks a parent folder as trashed while leaving child placements' parent_id intact — and the attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability held by every default WordPress role. This was also independently found by the OpenStation team.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_