Live › vulnerability › CVE-2026-111947
Go to dashboardThe Pricing Table WordPress plugin before 4.1.3 skips authorisation checks when duplicating a legacy pricing table. A user with the contributor role or above can clone and publish any post or page, including other users' private and draft content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Pricing Table plugin older than 4.1.3 that have legacy pricing tables and accounts with the contributor role or higher. Sites without this plugin or with only subscriber and customer accounts are not exposed.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=versionwp user list --role=contributor4.1.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-111947")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.