CVE-2026-1984 vowelweb CVE debrief

Who should care

WordPress administrators and security teams responsible for maintaining installations using the Ibtana – Ecommerce Product Addons plugin, especially those with Subscriber-level access or higher.

Why it matters

CVE-2026-1984 allows authenticated attackers with Subscriber-level access to update or delete arbitrary post meta entries, potentially leading to data integrity loss or site compromise. WordPress administrators and security teams should assess exposure and prioritize remediation for vulnerable installations.

• Potential data integrity loss due to unauthorized post meta modifications
• Increased risk of site compromise or data tampering
• Need for verification of plugin version and exposure
• Prioritization of remediation efforts for vulnerable installations

Technical summary

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This allows authenticated attackers with Subscriber-level access and above to update or delete arbitrary post meta entries via the 'iepa_builder' meta key. The vulnerability could lead to data integrity loss or site compromise if exploited. WordPress administrators and security teams should assess exposure and prioritize remediation for vulnerable installations.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the Ibtana – Ecommerce Product Addons plugin, especially versions up to 0.4.7.7.

Recommended defensive actions

• Inventory and assess exposure of WordPress installations using the Ibtana – Ecommerce Product Addons plugin
• Prioritize remediation for versions up to 0.4.7.7
• Monitor for suspicious post meta modifications
• Verify plugin version and update to a fixed version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is due to a missing capability check on the 'iepa_use_gt_editor' AJAX action. This allows authenticated attackers to update or delete post meta entries via the 'iepa_builder' meta key.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.