Description
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Broken Access Control
Action: Update Plugin
AI Analysis

Impact

The vulnerability is a broken access control flaw that allows a user with subscriber privileges to access or perform actions beyond normal scope within the WordPress Progress Planner plugin. The flaw can lead to unauthorized data manipulation or disclosure, compromising the confidentiality, integrity, and availability of the site’s content. The weakness is classified as CWE-862: Missing Authorization Checks.

Affected Systems

The issue affects the WordPress Progress Planner plugin versions 1.10.0 and earlier. Vulnerable installations are those running Progress Planner for WordPress prior to version 1.10.1.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity of this vulnerability. The EPSS score of 0.00338 indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web-based, where an authenticated subscriber could manipulate requests to the plugin’s endpoints and gain unauthorized access to protected functionality. No additional exploitation conditions are stated in the provided information.

Generated by OpenCVE AI on October 7, 2026 at 05:17 UTC.

Remediation

Vendor Solution

Update the WordPress Progress Planner plugin to the latest available version (at least 1.10.1).

OpenCVE Recommended Actions

  • Upgrade the WordPress Progress Planner plugin to version 1.10.1 or newer
  • Review and restrict subscriber role permissions to ensure they cannot access protected plugin functionality
  • Audit role assignments and plugin usage to confirm no residual elevated access remains

Generated by OpenCVE AI on October 7, 2026 at 05:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Progress Planner
Progress Planner progress Planner
Wordpress-extensions
Wordpress-extensions progress Planner
Vendors & Products Progress Planner
Progress Planner progress Planner
Wordpress-extensions
Wordpress-extensions progress Planner

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
Title WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Progress Planner Progress Planner
Wordpress-extensions Progress Planner
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:29.627Z

Reserved: 2026-07-13T06:14:48.066Z

Link: CVE-2026-62072

cve-icon Vulnrichment

Updated: 2026-10-06T10:28:32.252Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:56.500

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-62072

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:30:13Z

Weaknesses