Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access… (CVE-2026-112826)

The eLightUp Falcon – WordPress Optimizations & Tweaks plugin suffers from a missing authorization vulnerability (CWE-862) that allows attackers to exploit incorrectly configured access control security levels. This issue affects all versions up to and including 2.12.0. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is low, with no integrity or availability impacts reported. No known exploits are currently in the wild, and no patch or vendor advisory information is available to confirm remediation status.

The vulnerability could allow unauthorized users to access functionality or data that should be protected by access control mechanisms, potentially leading to limited confidentiality breaches. There is no reported impact on integrity or availability. The medium severity reflects the potential for unauthorized information disclosure without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations for the affected plugin. Monitor for vendor updates or security advisories regarding this vulnerability.