Live › vulnerability › CVE-2026-111396
Go to dashboardThe Advanced Post Manager WordPress plugin (advanced-post-manager) from Liquid Web / StellarWP has a missing authorization check, so access control is not enforced on some actions. The sources do not say which action an attacker can perform or what data they gain, beyond incorrectly configured access control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Advanced Post Manager plugin at version 4.5.6 or earlier are in scope according to the sources. The sources do not say which roles or configurations make a site exposed, so unknown.
No product ranges from the sources yet.
advanced-post-manager in the WordPress admin Plugins screen or with wp plugin get advanced-post-manager --field=versionadvanced-post-manager to a version later than 4.5.6, as the sources say the issue affects versions through 4.5.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-111396")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.