{"id":"CVE-2026-112826","kind":"vulnerability","aliases":["CVE-2026-112826"],"related":[],"title":"Falcon WordPress plugin: missing authorization lets unauthorized users change settings","description":"Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.","summary":"The Falcon WordPress optimization plugin from eLightUp is missing an authorization check in at least one function. Per the description, an attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.","severity":"medium","cvss":5.3,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["falcon","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Falcon plugin version in the WordPress admin under Plugins; the advisory covers versions through `2.12.0`\n- unknown whether the sources name the exact affected endpoint or setting","fix":"- Update Falcon – WordPress Optimizations & Tweaks to a version later than `2.12.0` once the vendor publishes one\n- unknown whether a patched version is available in the sources","status":"open","published_at":"2026-10-22T07:16:41+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:32+00:00","updated_at":"2026-10-25T04:20:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update Falcon – WordPress Optimizations & Tweaks to a version later than `2.12.0` once the vendor publishes one\n- unknown whether a patched version is available in the sources","reach":"internet","title":"Falcon WordPress plugin: missing authorization lets unauthorized users change settings","impact":"medium","summary":"The Falcon WordPress optimization plugin from eLightUp is missing an authorization check in at least one function. Per the description, an attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","falcon","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users change plugin settings on the site","analyst_note":"Check the NVD entry and the plugin changelog for the vulnerable endpoint, required privilege level and the first patched version.","how_to_check":"- Check the installed Falcon plugin version in the WordPress admin under Plugins; the advisory covers versions through `2.12.0`\n- unknown whether the sources name the exact affected endpoint or setting","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Falcon – WordPress Optimizations & Tweaks plugin at version `2.12.0` or earlier. The sources do not say which access control configuration is required to trigger it, so treat any site with the plugin installed as potentially exposed. Sites that have removed the plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3374,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112826':13A,16A '-2026':12A,15A '2.12.0':90C 'access':52B,77C 'action':57B 'affect':82C 'allow':62B,73C 'attack':47B 'author':5A,36B,64C 'chang':9A 'check':37B 'configur':51B,76C 'control':53B,78C 'cve':11A,14A 'descript':45B 'elightup':32B,67C 'exploit':49B,74C 'falcon':1A,17B,27B,68C,72C,83C 'function':42B 'host':21B 'incorrect':50B,75C 'issu':81C 'least':40B 'let':6A 'level':54B 'levels.this':80C 'miss':4A,34B,63C 'n/a':88C 'one':41B 'optim':29B,70C,85C 'packag':18B 'per':43B 'perform':56B 'plugin':3A,25B,30B 'secur':79C 'self':20B 'self-host':19B 'set':10A 'tweak':71C,86C 'unauthor':7A 'user':8A 'vulner':65C 'wordpress':2A,22B,24B,28B,69C,84C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Falcon – WordPress Optimizations & Tweaks plugin at version `2.12.0` or earlier. The sources do not say which access control configuration is required to trigger it, so treat any site with the plugin installed as potentially exposed. Sites that have removed the plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112826","severity":null,"published_at":"2026-10-22T07:16:41+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112826","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112826","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}