CVE-2026-18317: CWE-862 Missing Authorization in foxtheme Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
AI Analysis
Technical Summary
CVE-2026-18317 is an authorization bypass vulnerability (CWE-862) in the Foxtool All-in-One WordPress plugin (versions <=2.5.3). The plugin fails to properly verify user authorization for certain actions, enabling authenticated users with subscriber-level privileges or higher to modify arbitrary subkeys within the foxtool_settings option. This includes toggling the media-up3 key to enable site-wide SVG uploads, potentially facilitating stored cross-site scripting attacks through malicious SVG files.
Potential Impact
Authenticated users with subscriber-level access or higher can bypass authorization controls to modify plugin settings, including enabling site-wide SVG uploads. This can facilitate stored cross-site scripting attacks, which may lead to injection of malicious scripts affecting site visitors or administrators. The vulnerability does not impact confidentiality or availability directly but poses an integrity risk.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict subscriber-level user capabilities where possible and consider disabling or limiting SVG uploads to reduce risk. Avoid granting unnecessary privileges to low-level authenticated users.
CVE-2026-18317: CWE-862 Missing Authorization in foxtheme Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
Description
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
CVSS v3.1
Score 4.3medium
Affected software
foxtheme
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18317 is an authorization bypass vulnerability (CWE-862) in the Foxtool All-in-One WordPress plugin (versions <=2.5.3). The plugin fails to properly verify user authorization for certain actions, enabling authenticated users with subscriber-level privileges or higher to modify arbitrary subkeys within the foxtool_settings option. This includes toggling the media-up3 key to enable site-wide SVG uploads, potentially facilitating stored cross-site scripting attacks through malicious SVG files.
Potential Impact
Authenticated users with subscriber-level access or higher can bypass authorization controls to modify plugin settings, including enabling site-wide SVG uploads. This can facilitate stored cross-site scripting attacks, which may lead to injection of malicious scripts affecting site visitors or administrators. The vulnerability does not impact confidentiality or availability directly but poses an integrity risk.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict subscriber-level user capabilities where possible and consider disabling or limiting SVG uploads to reduce risk. Avoid granting unnecessary privileges to low-level authenticated users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-29T18:20:35.807Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aace1f355bf5e2cf5a3c67f
Added to database: 09/18/2026, 07:02:11 UTC
Last enriched: 09/18/2026, 07:17:28 UTC
Last updated: 09/19/2026, 03:59:30 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.