CVE-2026-110891: Missing Authorization in WordLift Srl WordLift

This vulnerability in WordLift arises from incorrectly configured access control security levels, resulting in missing authorization checks. It affects WordLift versions from the earliest through 3.54.16. The issue allows users with some privileges to exploit the lack of proper authorization, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact.

An attacker with some privileges can exploit this missing authorization to access or modify data beyond their intended permissions, leading to limited confidentiality and integrity breaches. There is no indication of availability impact or widespread exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict user privileges to the minimum necessary to reduce risk.