CVE-2026-111947
Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication
- State
- Published
- Severity
- 5.5 Medium
- Published
- Oct 21, 2026
- Updated
- Oct 21, 2026
- Reserved
- Oct 17, 2026
Description
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Pricing Table WordPress PluginUnknown |
|
References
- https://wpscan.com/vulnerability/7e78c101-05aa-4043-9c9d-2c896e9ae092/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.