Live › vulnerability › CVE-2026-110514
Go to dashboardThe WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user may edit a post before changing its type and order. A contributor-level user can turn any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WPZOOM Portfolio Lite before 1.4.34 that have accounts with the contributor role or above. The flaw lets those accounts change the type of content they did not write, so multi-author sites are most at risk. Sites without the plugin, or with it at 1.4.34 or later, are not affected.
No product ranges from the sources yet.
wp plugin get wpzoom-portfolio-lite --field=versionwp plugin list --status=active1.4.34 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
This page as .md · .json · in your agent: get_signal("CVE-2026-110514")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.