CVE-2026-101301: CWE-284 Improper Access Control in WPCode
Description
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
CVSS v3.1
Score 5.3medium
Affected software
WPCode
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WPCode WordPress plugin before version 2.4.0 contains an improper access control vulnerability (CWE-284). Specifically, it fails to correctly verify that a request is genuinely targeting the login screen before enabling snippet safe mode. This flaw enables unauthenticated users to disable all of the site's automatically inserted code snippets for their own requests, potentially altering site behavior for those requests.
Potential Impact
An unauthenticated attacker can disable all automatically inserted snippets on the site for their own requests. This could affect site functionality or security controls implemented via these snippets. The CVSS score is 5.3 (medium), reflecting limited confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should monitor vendor communications for updates and consider restricting access or disabling the plugin if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-28T13:28:59.432Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acf5e2e2cdf04f6566e4b1a
Added to database: 10/14/2026, 10:49:18 UTC
Last enriched: 10/14/2026, 11:04:16 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.