{"id":"CVE-2026-112843","kind":"vulnerability","aliases":["CVE-2026-112843"],"related":[],"title":"WordPress Strong Testimonials plugin: missing authorization check through 3.3.14","description":"Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.","summary":"The Strong Testimonials WordPress plugin, through version 3.3.14, has a missing authorization check on an access control path. An attacker may be able to perform actions they should not be allowed to perform.","severity":"medium","cvss":4.3,"epss":0.00152,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","strong-testimonials","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Strong Testimonials plugin in the WordPress admin plugins list, or with `wp plugin get strong-testimonials --field=version`\n- Compare the result against the fixed version, which the sources do not state","fix":"- Update Strong Testimonials to a version later than `3.3.14`; the exact fixed version is unknown from the sources\n- If no fixed version is available, deactivate the plugin until one is released","status":"open","published_at":"2026-10-22T07:16:41+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:37:25+00:00","updated_at":"2026-10-25T04:37:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:37:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update Strong Testimonials to a version later than `3.3.14`; the exact fixed version is unknown from the sources\n- If no fixed version is available, deactivate the plugin until one is released","reach":"internet","title":"WordPress Strong Testimonials plugin: missing authorization check through 3.3.14","impact":"medium","summary":"The Strong Testimonials WordPress plugin, through version 3.3.14, has a missing authorization check on an access control path. An attacker may be able to perform actions they should not be allowed to perform.","category":"package","nicknames":[],"who_cares":["wordpress","strong-testimonials"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized actions on the site, scope unknown from sources","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112843 for the affected function, required privilege, and the fixed version.","how_to_check":"- Check the installed version of the Strong Testimonials plugin in the WordPress admin plugins list, or with `wp plugin get strong-testimonials --field=version`\n- Compare the result against the fixed version, which the sources do not state","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Strong Testimonials WordPress plugin at version 3.3.14 or earlier are affected. Sites that do not use this plugin can skip it. The sources do not say which specific roles or settings make an install reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3346,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112843':12A,15A '-2026':11A,14A '3.3.14':9A,28B,80C 'abl':43B 'access':36B,69C 'action':46B 'affect':74C 'allow':51B,65C 'attack':40B 'author':6A,32B,55C 'check':7A,33B 'chill':59C 'configur':68C 'control':37B,70C 'cve':10A,13A 'exploit':66C 'incorrect':67C 'issu':73C 'levels.this':72C 'may':41B 'miss':5A,31B,54C 'n/a':78C 'packag':16B 'path':38B 'perform':45B,53B 'plugin':4A,25B 'secur':71C 'strong':2A,18B,22B,60C,63C,75C 'strong-testimoni':17B,62C 'testimoni':3A,19B,23B,61C,64C,76C 'version':27B 'vulner':56C 'wordpress':1A,20B,24B 'wp':58C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Strong Testimonials WordPress plugin at version 3.3.14 or earlier are affected. Sites that do not use this plugin can skip it. The sources do not say which specific roles or settings make an install reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T07:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112843","severity":null,"published_at":"2026-10-22T07:16:41+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112843","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112843","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}