{"id":"CVE-2026-115958","kind":"vulnerability","aliases":["CVE-2026-115958"],"related":[],"title":"WP Discussion Board: missing authorization check exposes protected actions","description":"Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0.","summary":"WP Discussion Board, a WordPress plugin, has a missing authorization check that lets requests reach functions without the proper access control. Sources do not say which actions an attacker can perform or what data they can read or change.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-discussion-board"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of `wp-discussion-board` in the WordPress admin plugin list or with `wp plugin get wp-discussion-board --field=version`\n- unknown for anything else","fix":"- Update `wp-discussion-board` to a version later than `2.6.0`, if a fixed release is published\n- unknown for any other step","status":"open","published_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:55+00:00","updated_at":"2026-10-26T10:30:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T10:30:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update `wp-discussion-board` to a version later than `2.6.0`, if a fixed release is published\n- unknown for any other step","reach":"internet","title":"WP Discussion Board: missing authorization check exposes protected actions","impact":"medium","summary":"WP Discussion Board, a WordPress plugin, has a missing authorization check that lets requests reach functions without the proper access control. Sources do not say which actions an attacker can perform or what data they can read or change.","category":"package","nicknames":[],"who_cares":["wordpress","wp-discussion-board"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to plugin functions, scope not stated by sources","analyst_note":"Find the advisory or changelog naming the fixed version and which plugin actions lack the authorization check (NVD entry CVE-2026-115958).","how_to_check":"- Check the installed plugin version of `wp-discussion-board` in the WordPress admin plugin list or with `wp plugin get wp-discussion-board --field=version`\n- unknown for anything else","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Discussion Board WordPress plugin at version `2.6.0` or earlier are in scope. Sources do not say which configurations or roles make the flaw reachable, so unknown for the rest.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000591,"input_tokens":3314,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115958':12A,15A '-2026':11A,14A '2.6.0':91C 'access':41B,79C 'action':9A,48B 'affect':84C 'allow':75C 'attack':50B 'author':5A,31B,62C 'board':3A,21B,24B,67C,70C,74C,87C 'chang':60B 'check':6A,32B 'configur':78C 'control':42B,80C 'cve':10A,13A 'data':55B 'discuss':2A,20B,23B,66C,69C,73C,86C 'exploit':76C 'expos':7A 'function':37B 'incorrect':77C 'issu':83C 'let':34B 'levels.this':82C 'miss':4A,30B,61C 'n/a':89C 'packag':16B 'perform':52B 'plugin':27B 'proper':40B 'protect':8A 'reach':36B 'read':58B 'request':35B 'say':46B 'secur':81C 'sourc':43B 'vulner':63C 'without':38B 'wordpress':17B,26B 'wp':1A,19B,22B,65C,68C,72C,85C 'wp-discussion-board':18B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Discussion Board WordPress plugin at version `2.6.0` or earlier are in scope. Sources do not say which configurations or roles make the flaw reachable, so unknown for the rest.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115958","severity":null,"published_at":"2026-10-26T10:16:52+00:00","modified_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}