PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-106603 Groundhogg CVE debrief

The CVE-2026-106603 vulnerability affects WordPress HollerBox plugin versions up to 2.3.14, allowing for authorization bypass through user-controlled keys due to an Insecure Direct Object References (IDOR) issue. Defenders should assess exposure, prioritize remediation, and verify the vulnerability's impact. This MEDIUM-severity vulnerability has a CVSS score of 6.5 and is classified as a potential authorization bypass and exploitation of incorrectly configured access control security levels. To address this vulnerability, defenders of WordPress installations using the HollerBox plugin, especially those with untrusted users or publicly accessible sites, should assess exposure and

Vendor
Groundhogg
Product
HollerBox
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-08
Original CVE updated
2026-10-08
Advisory published
2026-10-08
Advisory updated
2026-10-08

Who should care

Defenders of WordPress installations using the HollerBox plugin, especially those with untrusted users or publicly accessible sites, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-106603 is a MEDIUM-severity vulnerability in the WordPress HollerBox plugin, versions up to 2.3.14. Defenders should assess exposure, prioritize remediation, and verify the vulnerability's impact due to potential authorization bypass and exploitation of incorrectly configured access control security levels.

  • Potential authorization bypass through user-controlled keys
  • Possible exploitation of incorrectly configured access control security levels
  • Verification of vulnerability impact and user-controlled key usage required
  • Remediation priority for WordPress installations using affected HollerBox plugin versions

Technical summary

The WordPress HollerBox plugin, versions up to 2.3.14, is vulnerable to an Insecure Direct Object References (IDOR) issue. This allows for authorization bypass through user-controlled keys. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.

Defensive priority

Medium priority for defenders of WordPress installations using the HollerBox plugin, especially those with untrusted users or publicly accessible sites.

Recommended defensive actions

  • Assess exposure of HollerBox plugin versions up to 2.3.14 in WordPress installations
  • Prioritize remediation or upgrade to version 2.3.15 or later
  • Verify vulnerability impact and check for potential user-controlled key exploitation
  • Monitor for suspicious activity related to HollerBox plugin usage

Evidence notes

The CVE record and source item provide details on the vulnerability. However, additional information on exploitation, impact, or remediation may be required for thorough assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-106603 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-106603

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-106603 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-106603

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.