CVE-2026-14305: CWE-287 Improper Authentication in WP Delicious
WP Delicious WordPress plugin versions before 1.10.2 contain an improper authentication vulnerability. This flaw allows unauthenticated users to modify certain post metadata via an AJAX action without authorization checks. Specifically, attackers can inflate a like counter and add to an associated identifier list on arbitrary posts.
AI Analysis
Technical Summary
CVE-2026-14305 describes an improper authentication vulnerability (CWE-287) in the WP Delicious WordPress plugin prior to version 1.10.2. The plugin fails to perform authorization checks on one of its AJAX actions, enabling unauthenticated users to modify limited post metadata such as a like counter and an identifier list. This can lead to unauthorized manipulation of post metadata, including artificially inflating counters and growing stored metadata without bounds.
Potential Impact
The vulnerability allows unauthenticated attackers to modify post metadata, specifically inflating like counters and adding identifiers arbitrarily. This does not impact confidentiality or availability but affects data integrity by allowing unauthorized modification of post metadata.
Mitigation Recommendations
No official patch or remediation level has been confirmed yet. Users should monitor the vendor advisory for updates and apply the official fix once it becomes available. Until then, restricting access to AJAX endpoints or disabling the affected plugin may reduce risk.
CVE-2026-14305: CWE-287 Improper Authentication in WP Delicious
Description
WP Delicious WordPress plugin versions before 1.10.2 contain an improper authentication vulnerability. This flaw allows unauthenticated users to modify certain post metadata via an AJAX action without authorization checks. Specifically, attackers can inflate a like counter and add to an associated identifier list on arbitrary posts.
CVSS v3.1
Score 5.3medium
Affected software
WP Delicious
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14305 describes an improper authentication vulnerability (CWE-287) in the WP Delicious WordPress plugin prior to version 1.10.2. The plugin fails to perform authorization checks on one of its AJAX actions, enabling unauthenticated users to modify limited post metadata such as a like counter and an identifier list. This can lead to unauthorized manipulation of post metadata, including artificially inflating counters and growing stored metadata without bounds.
Potential Impact
The vulnerability allows unauthenticated attackers to modify post metadata, specifically inflating like counters and adding identifiers arbitrarily. This does not impact confidentiality or availability but affects data integrity by allowing unauthorized modification of post metadata.
Mitigation Recommendations
No official patch or remediation level has been confirmed yet. Users should monitor the vendor advisory for updates and apply the official fix once it becomes available. Until then, restricting access to AJAX endpoints or disabling the affected plugin may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-01T11:10:18.024Z
- State
- PUBLISHED
Threat ID: 6a6aee099c2644c7f8a7ef64
Added to database: 07/30/2026, 06:24:09 UTC
Last enriched: 08/06/2026, 17:59:00 UTC
Last updated: 09/13/2026, 22:01:31 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.