Description
Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.
Published: 2026-04-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Immediate Patch
AI Analysis

Impact

The NitroPack plugin for WordPress contains a missing authorization check that permits any web visitor to access privileged configuration functions. This broken access control flaw allows an attacker to read or alter plugin settings, potentially degrading site performance or enabling further attacks. The weakness is classified as CWE-862.

Affected Systems

WordPress installations running NitroPack versions up to and including 1.19.3 are affected. All releases from the first available version through 1.19.3 lack the necessary protections. The vulnerability is tied solely to the NitroPack plugin and does not extend beyond it.

Risk and Exploitability

The vulnerability carries a score of 5.3, indicating moderate severity. Exploitation is considered unlikely, with an exploitation probability below 1%, and it is not currently listed in the CISA KEV catalog. The flaw can be reached remotely by sending HTTP requests to NitroPack endpoints that omit authentication checks, requiring no special credentials or additional software.

Generated by OpenCVE AI on April 28, 2026 at 16:31 UTC.

Remediation

Vendor Solution

Update the WordPress NitroPack plugin to the latest available version (at least 1.19.4).

OpenCVE Recommended Actions

  • Upgrade NitroPack to a version newer than 1.19.3.
  • Verify that the plugin’s administrative interfaces are protected by authentication.
  • If upgrading is not feasible, limit public access to NitroPack configuration URLs through server or firewall rules.

Generated by OpenCVE AI on April 28, 2026 at 16:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 12:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Apr 2026 11:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in NitroPack NitroPack nitropack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through <= 1.19.3. Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Mon, 13 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Nitropack
Nitropack nitropack
Wordpress
Wordpress wordpress
Vendors & Products Nitropack
Nitropack nitropack
Wordpress
Wordpress wordpress

Wed, 08 Apr 2026 08:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in NitroPack NitroPack nitropack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through <= 1.19.3.
Title WordPress NitroPack plugin <= 1.19.3 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Nitropack Nitropack
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T17:23:59.096Z

Reserved: 2026-04-07T10:57:59.671Z

Link: CVE-2026-39669

cve-icon Vulnrichment

Updated: 2026-04-13T18:18:55.814Z

cve-icon NVD

Status : Deferred

Published: 2026-04-08T09:16:38.297

Modified: 2026-04-28T19:37:39.030

Link: CVE-2026-39669

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T16:45:06Z

Weaknesses