CVE-2026-62035: CWE-862 Missing Authorization in upcasted AWS S3 for WordPress Plugin – Upcasted

This vulnerability (CWE-862) in the AWS S3 for WordPress Plugin – Upcasted versions up to 3.1.0 involves broken access control due to missing authorization checks. The flaw allows users with limited privileges to perform actions or access data they should not be authorized for. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vendor has released a patch to fix this issue.

Exploitation of this vulnerability could lead to unauthorized access and modification of data stored or managed via the plugin, impacting confidentiality, integrity, and availability of affected systems. However, exploitation requires at least low-level privileges, and no known exploits are currently in the wild.

A patch is available from the vendor to remediate this vulnerability. Users of AWS S3 for WordPress Plugin – Upcasted should apply the official update to versions later than 3.1.0 as soon as possible to mitigate the risk. Since this is a cloud service plugin, the vendor manages remediation for the cloud-hosted components; users should verify they are running patched plugin versions.