Description

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T13:18:07.777Z",
  "pubdate": "2026-08-19T13:18:07.777Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability exists in the Outranking plugin versions 1.1.3 and below. This security flaw allows unauthenticated remote attackers to interact with vulnerable plugin options handlers without proper authorization checks or session validation.\nThe primary impact of this vulnerability is the potential exposure, modification, or unauthorized management of plugin settings and internal configurations, which could lead to further security degradation of the host WordPress installation.\nThe affected product is the Outranking plugin, specifically all versions up to and including 1.1.3. The risk implications are significant as unauthorized external entities can manipulate sensitive plugin parameters without requiring valid user credentials or administrative privileges.\nThe attacker capabilities include sending crafted HTTP requests directly to the exposed functionality over the network. Exploitation requirements are minimal, primarily consisting of network connectivity to the targeted WordPress site and knowledge of the vulnerable plugin endpoints, as no authentication or prior system access is required to trigger the flawed access control logic.",
  "technicalDetails": "The vulnerability stems from insufficient access control checks within the plugin options handling mechanism of the Outranking plugin. Specifically, the affected component fails to properly validate whether an incoming request originates from an authenticated user with administrative or appropriate capabilities before processing administrative actions or modifying plugin options.\nThe root cause is an absence of proper capability checks (such as current_user_can calls) and nonce verification on sensitive AJAX actions, REST API endpoints, or direct administrative script handlers exposed by the plugin. Consequently, any unauthenticated network entity can invoke these backend functions.\nThe attack flow proceeds as follows: First, the attacker identifies a target running a vulnerable version of the Outranking plugin (<= 1.1.3). Second, the attacker formulates an HTTP request targeting the exposed plugin options handler endpoint. Because the application logic lacks proper session authentication and privilege verification, the request is processed by the server as if it came from a legitimate administrator.\nThe payload behavior involves interacting with the plugin's internal options management functions, potentially allowing the unauthorized reading of sensitive configuration data or the unauthorized writing and updating of plugin settings. The network exposure is public-facing, as WordPress plugins are typically accessible via standard HTTP/HTTPS protocols over the internet.\nPost-exploitation impact depends on the specific options exposed by the plugin, but generally includes unauthorized state changes, potential data tampering, and the manipulation of SEO or content parameters managed by the Outranking plugin, which may facilitate secondary attacks or disrupt site functionality."
}