{"id":"CVE-2026-111396","kind":"vulnerability","aliases":["CVE-2026-111396"],"related":[],"title":"Advanced Post Manager WordPress plugin: missing authorization check through 4.5.6","description":"Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.","summary":"The Advanced Post Manager WordPress plugin (advanced-post-manager) from Liquid Web / StellarWP has a missing authorization check, so access control is not enforced on some actions. The sources do not say which action an attacker can perform or what data they gain, beyond incorrectly configured access control.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":[],"how_to_check":"- Check the installed plugin version of `advanced-post-manager` in the WordPress admin Plugins screen or with `wp plugin get advanced-post-manager --field=version`\n- unknown for any other check, as the sources do not say which endpoint or setting is involved","fix":"- Update `advanced-post-manager` to a version later than `4.5.6`, as the sources say the issue affects versions through `4.5.6`\n- unknown for the fixed version number, as the sources do not say it","status":"open","published_at":"2026-10-16T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:46+00:00","updated_at":"2026-10-25T03:36:46+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T03:36:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update `advanced-post-manager` to a version later than `4.5.6`, as the sources say the issue affects versions through `4.5.6`\n- unknown for the fixed version number, as the sources do not say it","reach":"unknown","title":"Advanced Post Manager WordPress plugin: missing authorization check through 4.5.6","impact":"medium","summary":"The Advanced Post Manager WordPress plugin (advanced-post-manager) from Liquid Web / StellarWP has a missing authorization check, so access control is not enforced on some actions. The sources do not say which action an attacker can perform or what data they gain, beyond incorrectly configured access control.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: sources only say access control is incorrectly configured","analyst_note":"Find the vendor advisory or the Wordfence/patchstack entry for the affected function, the fixed version and the required privilege, using the NVD link https://nvd.nist.gov/vuln/detail/CVE-2026-111396.","how_to_check":"- Check the installed plugin version of `advanced-post-manager` in the WordPress admin Plugins screen or with `wp plugin get advanced-post-manager --field=version`\n- unknown for any other check, as the sources do not say which endpoint or setting is involved","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Advanced Post Manager plugin at version 4.5.6 or earlier are in scope according to the sources. The sources do not say which roles or configurations make a site exposed, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000644,"input_tokens":3319,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111396':13A,16A '-2026':12A,15A '4.5.6':10A,104C 'access':45B,72B,92C 'action':52B,59B 'advanc':1A,26B,32B,81C,85C,98C 'advanced-post-manag':31B,84C 'affect':97C 'allow':88C 'attack':61B 'author':7A,42B,75C 'beyond':69B 'check':8A,43B 'configur':71B,91C 'control':46B,73B,93C 'cve':11A,14A 'data':66B 'enforc':49B 'exploit':89C 'gain':68B 'host':20B 'incorrect':70B,90C 'issu':96C 'levels.this':95C 'liquid':36B,78C 'manag':3A,28B,34B,83C,87C,100C 'miss':6A,41B,74C 'n/a':102C 'packag':17B 'perform':63B 'plugin':5A,24B,30B 'post':2A,27B,33B,82C,86C,99C 'say':57B 'secur':94C 'self':19B 'self-host':18B 'sourc':54B 'stellarwp':38B,80C 'vulner':76C 'web':37B,79C 'wordpress':4A,21B,23B,29B 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Post Manager plugin at version 4.5.6 or earlier are in scope according to the sources. The sources do not say which roles or configurations make a site exposed, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111396","severity":null,"published_at":"2026-10-16T13:16:55+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}