---
id: "CVE-2026-111396"
kind: "vulnerability"
aliases: ["CVE-2026-111396"]
title: "Advanced Post Manager WordPress plugin: missing authorization check through 4.5.6"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: []
published_at: "2026-10-16T13:16:55+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:36:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111396", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Advanced Post Manager WordPress plugin: missing authorization check through 4.5.6

The Advanced Post Manager WordPress plugin (advanced-post-manager) from Liquid Web / StellarWP has a missing authorization check, so access control is not enforced on some actions. The sources do not say which action an attacker can perform or what data they gain, beyond incorrectly configured access control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version of `advanced-post-manager` in the WordPress admin Plugins screen or with `wp plugin get advanced-post-manager --field=version`
- unknown for any other check, as the sources do not say which endpoint or setting is involved

## Fix

- Update `advanced-post-manager` to a version later than `4.5.6`, as the sources say the issue affects versions through `4.5.6`
- unknown for the fixed version number, as the sources do not say it

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111396

## From the sources

Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_