PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-0674 Patchstack CVE debrief

CVE-2026-0674 describes a missing-authorization / broken-access-control issue in Campaign Monitor for WordPress, affecting versions through 2.9.1. Based on the supplied NVD record and Patchstack reference, the flaw can allow a low-privileged actor to reach actions that should require stronger authorization, creating an integrity risk for affected WordPress sites.

Vendor
Patchstack
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-08
Original CVE updated
2026-05-11
Advisory published
2026-01-08
Advisory updated
2026-05-11

Who should care

WordPress site owners and administrators running Campaign Monitor for WordPress, especially sites that allow multiple authenticated roles or delegate plugin administration to non-admin users.

Technical summary

The supplied record maps this issue to CWE-862 and rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3). The vulnerability is described as missing authorization / incorrectly configured access-control security levels in the Campaign Monitor for WordPress plugin, with the affected range listed as n/a through 2.9.1. The provided vector indicates no confidentiality or availability impact, but unauthorized state changes or access to restricted plugin functions may be possible.

Defensive priority

Medium. The issue is network-reachable, low-complexity, and requires only low privileges, but the supplied CVSS vector limits the impact to integrity.

Recommended defensive actions

  • Inventory all WordPress instances using Campaign Monitor for WordPress and confirm whether any are at or below version 2.9.1.
  • Upgrade to a vendor-fixed release newer than 2.9.1 if one is available; if no fix is published, disable or remove the plugin until remediation is confirmed.
  • Restrict WordPress roles and review which accounts can access plugin-related pages, settings, or actions.
  • Review WordPress and plugin logs for unexpected configuration changes or other unauthorized activity, especially around and after 2026-01-08.
  • Track the NVD record and the Patchstack reference for remediation updates and any additional guidance.

Evidence notes

The source corpus contains an official NVD record with VulnStatus=Deferred and a Patchstack reference describing a broken-access-control vulnerability in the Campaign Monitor for WordPress plugin. The supplied data does not include a fixed version, exploit details, or confirmation of real-world exploitation. Vendor attribution confidence is low in the prompt metadata and is marked as needing review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-0674 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-0674

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-0674 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-0674

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.