CVE-2026-14305: CWE-287 Improper Authentication in WP Delicious
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.
AI Analysis
Technical Summary
The WP Delicious plugin for WordPress prior to version 1.10.2 fails to perform authorization checks on one of its AJAX actions. This improper authentication (CWE-287) vulnerability permits unauthenticated users to modify limited post metadata on arbitrary posts, including inflating a like counter and expanding the associated identifier list indefinitely. No CVSS score or official remediation details are provided, and no known exploits are reported in the wild.
Potential Impact
Unauthenticated attackers can manipulate post metadata, specifically inflating like counters and growing stored metadata arbitrarily. This could lead to inaccurate post statistics and potential resource exhaustion due to unbounded metadata growth. There is no indication of further impact such as code execution or data disclosure.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX action if possible or disable the plugin to prevent exploitation.
CVE-2026-14305: CWE-287 Improper Authentication in WP Delicious
Description
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP Delicious plugin for WordPress prior to version 1.10.2 fails to perform authorization checks on one of its AJAX actions. This improper authentication (CWE-287) vulnerability permits unauthenticated users to modify limited post metadata on arbitrary posts, including inflating a like counter and expanding the associated identifier list indefinitely. No CVSS score or official remediation details are provided, and no known exploits are reported in the wild.
Potential Impact
Unauthenticated attackers can manipulate post metadata, specifically inflating like counters and growing stored metadata arbitrarily. This could lead to inaccurate post statistics and potential resource exhaustion due to unbounded metadata growth. There is no indication of further impact such as code execution or data disclosure.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX action if possible or disable the plugin to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-01T11:10:18.024Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6aee099c2644c7f8a7ef64
Added to database: 07/30/2026, 06:24:09 UTC
Last enriched: 07/30/2026, 06:54:02 UTC
Last updated: 07/30/2026, 21:34:43 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.