PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45216 StoreApps CVE debrief

CVE-2026-45216 is a HIGH severity (CVSS 8.8) Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager, a WordPress plugin. The vulnerability allows authenticated attackers with low privileges to escalate their privileges, potentially gaining full administrative control. The issue affects all versions from n/a through 8.85.0. The vulnerability was published in the NVD on May 25, 2026, with a subsequent modification on May 26, 2026. The weakness is classified as CWE-266 (Incorrect Privilege Assignment). The vendor attribution is currently marked as needing review with low confidence, based on reference domain analysis pointing to Patchstack as the source. No known exploitation in ransomware campaigns has been reported, and this CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor
StoreApps
Product
Smart Manager
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-05-26
Advisory published
2026-05-25
Advisory updated
2026-05-26

Who should care

WordPress site administrators using StoreApps Smart Manager plugin; security teams managing WordPress installations; managed service providers hosting WordPress environments; compliance officers tracking vulnerability remediation timelines

Technical summary

The Smart Manager plugin for WordPress contains an Incorrect Privilege Assignment vulnerability (CWE-266) that enables authenticated users with low privileges to escalate to higher privilege levels. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, low privileges required, no user interaction needed, and high impact across confidentiality, integrity, and availability. The vulnerability exists in code paths handling privilege checks, where insufficient validation allows privilege boundary violations.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade StoreApps Smart Manager to a version newer than 8.85.0 if available
  • Verify plugin version through WordPress admin dashboard or file system inspection
  • Review user role assignments and capabilities for unexpected privilege grants
  • Monitor WordPress audit logs for suspicious privilege escalation activity
  • Consider temporarily disabling the plugin if patching is not immediately feasible and the functionality is not critical
  • Apply principle of least privilege for all WordPress user accounts

Evidence notes

CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-266 identified as primary weakness. Affected versions confirmed through 8.85.0. Vendor attribution confidence is low and flagged for review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45216 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45216

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45216 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45216

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.