CVE-2026-111947: CWE-639 Authorization Bypass Through User-Controlled Key in Pricing Table WordPress Plugin
Description
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
CVSS v3.1
Score 5.5medium
Affected software
Pricing Table WordPress Plugin
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111947 describes an authorization bypass vulnerability (CWE-639) in the Pricing Table WordPress Plugin versions prior to 4.1.3. The plugin fails to enforce authorization checks when duplicating legacy pricing tables, enabling users with contributor or higher roles to clone and publish any post or page, including private and draft content belonging to other users. This vulnerability arises from improper access control in the duplication functionality.
Potential Impact
An attacker with contributor-level access or higher can exploit this vulnerability to clone and publish content they normally should not have access to, including private and draft posts or pages. This could lead to unauthorized disclosure of sensitive content and potential content integrity issues on the affected WordPress site.
Mitigation Recommendations
Upgrade the Pricing Table WordPress Plugin to version 4.1.3 or later, where this authorization bypass vulnerability has been fixed. No other mitigation steps are specified. Patch status is confirmed by the version boundary provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-17T14:45:09.633Z
- State
- PUBLISHED
Threat ID: 6ad855dc2cdf04f656afec26
Added to database: 10/21/2026, 06:04:12 UTC
Last enriched: 10/21/2026, 06:33:46 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.