---
id: "CVE-2026-112826"
kind: "vulnerability"
aliases: ["CVE-2026-112826"]
title: "Falcon WordPress plugin: missing authorization lets unauthorized users change settings"
severity: "medium"
cvss: 5.3
epss: 0.00187
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["falcon", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T07:16:41+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112826", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112826", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Falcon WordPress plugin: missing authorization lets unauthorized users change settings

The Falcon WordPress optimization plugin from eLightUp is missing an authorization check in at least one function. Per the description, an attacker can exploit incorrectly configured access control levels to perform actions they should not be allowed to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Falcon plugin version in the WordPress admin under Plugins; the advisory covers versions through `2.12.0`
- unknown whether the sources name the exact affected endpoint or setting

## Fix

- Update Falcon – WordPress Optimizations & Tweaks to a version later than `2.12.0` once the vendor publishes one
- unknown whether a patched version is available in the sources

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112826
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112826

## From the sources

Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_