Live › vulnerability › CVE-2026-116855
Go to dashboardThe free edition of the My Auctions Allegro WordPress plugin, by wphocus, has a missing authorization check, so access control is not enforced on some actions. The sources do not say which action an attacker can perform or what data they can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 12:32 UTC. All times on this page are UTC.
Sites running the My Auctions Allegro free edition plugin at version or earlier are in scope. The sources do not say which configuration or role is needed to reach the flaw, so unknown for who can skip it.
4.0.3No product ranges from the sources yet.
wp plugin list4.0.3, if the vendor has released oneEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-116855")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.