Description

Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T12:16:35.323Z",
  "pubdate": "2026-08-20T12:16:35.323Z",
  "executiveSummary": "A broken access control vulnerability exists in the Homlisti plugin in versions less than or equal to 3.1.2.\nThis security flaw allows authenticated users with low-privileged subscriber roles to perform unauthorized actions or access restricted functionalities that should be strictly restricted to higher-privileged administrators or authorized users.\nThe vulnerability exposes the affected WordPress systems to potential privilege abuse, unauthorized data manipulation, or state changes depending on the specific endpoints exposed.\nAn attacker possessing standard subscriber-level credentials can leverage this flaw by sending crafted requests directly to vulnerable application endpoints, bypassing intended authorization checks implemented within the access control logic of the plugin.\nThe risk implication is moderate to high, as it compromises the principle of least privilege and allows low-privileged actors to exceed their assigned permissions within the application context.\nSuccessful exploitation requires the attacker to authenticate as a subscriber, meaning open registration or prior compromise of a subscriber account is a prerequisite for executing the attack flow.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate or missing authorization checks within the request handling mechanisms of the Homlisti product in versions <= 3.1.2.\nSpecifically, backend functions or AJAX actions exposed by the plugin fail to validate whether the currently authenticated user possesses the necessary capabilities or administrative privileges required to execute specific sensitive operations.\nThe vulnerable component resides within the access control enforcement layer of the plugin codebase, where user session validation occurs without verifying role-based access constraints for specific sensitive functions.\nBecause the application relies solely on the presence of a valid user session rather than verifying user capabilities against the requested action, a user authenticated with the subscriber role can invoke restricted methods.\nThe attack flow proceeds as follows: First, the attacker authenticates to the target WordPress instance using a standard subscriber-level account. Second, the attacker identifies the exposed functional endpoints or AJAX handlers utilized by the Homlisti plugin. Third, the attacker crafts an HTTP request targeting these restricted functions, often modifying parameters or directly invoking the backend action handlers. Fourth, the vulnerable server-side code processes the request without performing adequate capability checks, executing the privileged operation on behalf of the low-privileged user.\nThe network exposure includes any environment where the Homlisti plugin is active and accessible via HTTP/HTTPS protocols.\nAuthentication is required in the form of a valid subscriber session, but further privilege requirements are absent due to the flaw.\nPost-exploitation impact depends on the specific functions exposed to the improper access control, potentially allowing unauthorized data modification, setting manipulation, or interaction with features reserved for administrative roles."
}