{"id":"CVE-2026-123470","kind":"vulnerability","aliases":["CVE-2026-123470"],"related":[],"title":"HivePress WordPress plugin: missing authorization check exposes access control weakness","description":"Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.","summary":"HivePress, a WordPress plugin for building marketplace and directory sites, has a missing authorization check that lets requests bypass intended access control levels. An attacker may be able to perform actions or see data their account should not reach.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hivepress","marketplace-sites","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed HivePress version in the WordPress admin plugin list or `wp plugin get hivepress --field=version`\n- Confirm whether the site runs HivePress at all (unknown beyond this)","fix":"- HivePress: versions after `1.8.1` (the sources do not name the fixed version)","status":"open","published_at":"2026-11-07T11:17:01+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:35+00:00","updated_at":"2026-11-07T11:48:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:35Z","model":"claude-haiku-5-5","output":{"fix":"- HivePress: versions after `1.8.1` (the sources do not name the fixed version)","reach":"internet","title":"HivePress WordPress plugin: missing authorization check exposes access control weakness","impact":"medium","summary":"HivePress, a WordPress plugin for building marketplace and directory sites, has a missing authorization check that lets requests bypass intended access control levels. An attacker may be able to perform actions or see data their account should not reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","hivepress","marketplace-sites"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted functions or data","analyst_note":"Find the vendor advisory or NVD detail for the affected endpoints, required role, and the fixed version beyond 1.8.1.","how_to_check":"- Check the installed HivePress version in the WordPress admin plugin list or `wp plugin get hivepress --field=version`\n- Confirm whether the site runs HivePress at all (unknown beyond this)","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the HivePress plugin up to and including version 1.8.1 are in scope according to the description. The sources do not say which roles or endpoints are involved, so whether a logged-out visitor can reach the flaw is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4205,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123470':13A,16A '-2026':12A,15A '1.8.1':83C 'abl':50B 'access':8A,43B,73C 'account':58B 'action':53B 'affect':78C 'allow':69C 'attack':47B 'author':5A,36B,63C 'build':28B 'bypass':41B 'check':6A,37B 'configur':72C 'control':9A,44B,74C 'cve':11A,14A 'data':56B 'directori':31B 'exploit':70C 'expos':7A 'hivepress':1A,17B,23B,66C,67C,68C,79C 'incorrect':71C 'intend':42B 'issu':77C 'let':39B 'level':45B 'levels.this':76C 'marketplac':19B,29B 'marketplace-sit':18B 'may':48B 'miss':4A,35B,62C 'n/a':81C 'packag':21B 'perform':52B 'plugin':3A,26B 'reach':61B 'request':40B 'secur':75C 'see':55B 'site':20B,32B 'vulner':64C 'weak':10A 'wordpress':2A,22B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the HivePress plugin up to and including version 1.8.1 are in scope according to the description. The sources do not say which roles or endpoints are involved, so whether a logged-out visitor can reach the flaw is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hivepress","marketplacesites","medium","package","wordpress"],"campaign_type":null,"search_a":"'-123470':13A,16A '-2026':12A,15A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':11A,14A 'expos':7A 'hivepress':1A 'miss':4A 'plugin':3A 'weak':10A 'wordpress':2A","search_b":"'abl':50B 'access':43B 'account':58B 'action':53B 'attack':47B 'author':36B 'build':28B 'bypass':41B 'check':37B 'control':44B 'data':56B 'directori':31B 'hivepress':17B,23B 'intend':42B 'let':39B 'level':45B 'marketplac':19B,29B 'marketplace-sit':18B 'may':48B 'miss':35B 'packag':21B 'perform':52B 'plugin':26B 'reach':61B 'request':40B 'see':55B 'site':20B,32B 'wordpress':22B,25B","search_c":"'1.8.1':83C 'access':73C 'affect':78C 'allow':69C 'author':63C 'configur':72C 'control':74C 'exploit':70C 'hivepress':66C,67C,68C,79C 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':62C 'n/a':81C 'secur':75C 'vulner':64C","first_public_at":"2026-11-07T11:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123470","severity":null,"published_at":"2026-11-07T11:17:01+00:00","modified_at":"2026-11-07T11:17:01+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}