{"id":"CVE-2026-42707","kind":"vulnerability","aliases":["CVE-2026-42707"],"related":[],"title":"HivePress Claim Listings: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.","summary":"HivePress Claim Listings is a WordPress plugin for claiming business listings. A missing authorization check lets an attacker reach functions their role should not allow, due to incorrectly configured access control.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hivepress","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/hivepress-claim-listings/`.\n- Confirm whether the installed version is `1.1.4` or earlier.","fix":"- HivePress Claim Listings: unknown (sources state the affected range through 1.1.4 but no fixed version)","status":"open","published_at":"2026-10-29T14:17:55+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:17+00:00","updated_at":"2026-10-29T14:26:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T14:26:17Z","model":"claude-haiku-5-5","output":{"fix":"- HivePress Claim Listings: unknown (sources state the affected range through 1.1.4 but no fixed version)","reach":"internet","title":"HivePress Claim Listings: missing authorization lets users bypass access controls","impact":"medium","summary":"HivePress Claim Listings is a WordPress plugin for claiming business listings. A missing authorization check lets an attacker reach functions their role should not allow, due to incorrectly configured access control.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","hivepress","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users perform actions reserved for higher-privilege roles","analyst_note":"Confirm the fixed version and the specific unauthorized actions from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/hivepress-claim-listings/`.\n- Confirm whether the installed version is `1.1.4` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the HivePress Claim Listings WordPress plugin at version 1.1.4 or earlier. The flaw is an access control issue, so exposure depends on which roles and endpoints the site exposes; sites without the plugin are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4124,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-42707':13A,16A '1.1.4':82C 'access':9A,52B,70C 'affect':75C 'allow':47B,66C 'attack':40B 'author':5A,36B,55C 'busi':32B 'bypass':8A 'check':37B 'claim':2A,24B,31B,60C,64C,77C 'configur':51B,69C 'control':10A,53B,71C 'cve':11A,14A 'due':48B 'exploit':67C 'function':42B 'hivepress':1A,17B,23B,58C,59C,63C,76C 'hivepress-claim-list':62C 'host':21B 'incorrect':50B,68C 'issu':74C 'let':6A,38B 'levels.this':73C 'list':3A,25B,33B,61C,65C,78C 'miss':4A,35B,54C 'n/a':80C 'packag':18B 'plugin':29B 'reach':41B 'role':44B 'secur':72C 'self':20B 'self-host':19B 'user':7A 'vulner':56C 'wordpress':22B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the HivePress Claim Listings WordPress plugin at version 1.1.4 or earlier. The flaw is an access control issue, so exposure depends on which roles and endpoints the site exposes; sites without the plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42707","severity":null,"published_at":"2026-10-29T14:17:55+00:00","modified_at":"2026-10-29T14:17:55+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}