CVE-2026-4792: CWE-862 Missing Authorization in radius314 Bread
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
AI Analysis
Technical Summary
CVE-2026-4792 describes a missing authorization vulnerability (CWE-862) in the Bread plugin for WordPress by radius314. Versions up to and including 2.9.12 are affected. The issue is due to the download_settings function being registered on the plugins_loaded hook and explicitly allowed to execute on non-admin pages without authentication. This function exports all plugin configuration settings, including the sensitive protection_password field stored in plaintext. An unauthenticated attacker can exploit this by accessing the /?export-meeting-list=1 endpoint, leading to information exposure of sensitive configuration data.
Potential Impact
An unauthenticated attacker can retrieve sensitive configuration data from the plugin, including the PDF protection password stored in plaintext. This exposure can lead to unauthorized access to protected PDF content or other misuse of the plugin's configuration. The CVSS score of 5.3 (medium severity) reflects the network attack vector with no privileges or user interaction required, but limited to information disclosure without direct integrity or availability impact.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update the Bread plugin to a version later than 2.9.12 where this issue is fixed. Since this is a cloud-hosted WordPress plugin, the vendor or hosting provider may also manage remediation. Check the vendor advisory or plugin update notes for the official fix and apply it promptly to prevent exploitation.
CVE-2026-4792: CWE-862 Missing Authorization in radius314 Bread
Description
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
CVSS v3.1
Score 5.3medium
Affected software
radius314
Bread
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4792 describes a missing authorization vulnerability (CWE-862) in the Bread plugin for WordPress by radius314. Versions up to and including 2.9.12 are affected. The issue is due to the download_settings function being registered on the plugins_loaded hook and explicitly allowed to execute on non-admin pages without authentication. This function exports all plugin configuration settings, including the sensitive protection_password field stored in plaintext. An unauthenticated attacker can exploit this by accessing the /?export-meeting-list=1 endpoint, leading to information exposure of sensitive configuration data.
Potential Impact
An unauthenticated attacker can retrieve sensitive configuration data from the plugin, including the PDF protection password stored in plaintext. This exposure can lead to unauthorized access to protected PDF content or other misuse of the plugin's configuration. The CVSS score of 5.3 (medium severity) reflects the network attack vector with no privileges or user interaction required, but limited to information disclosure without direct integrity or availability impact.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update the Bread plugin to a version later than 2.9.12 where this issue is fixed. Since this is a cloud-hosted WordPress plugin, the vendor or hosting provider may also manage remediation. Check the vendor advisory or plugin update notes for the official fix and apply it promptly to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-24T21:24:56.620Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6aae3e0255bf5e2cf54897d5
Added to database: 09/19/2026, 07:47:14 UTC
Last enriched: 09/19/2026, 08:02:23 UTC
Last updated: 09/19/2026, 22:12:52 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.