PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24582 WPPOOL CVE debrief

A Missing Authorization vulnerability in the WPPOOL FlexTable WordPress plugin allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability affects all versions from n/a through 3.24.0. The issue was published to the CVE List on 2026-05-25 and last modified on 2026-05-26. The NVD entry currently shows a status of 'Deferred'.

Vendor
WPPOOL
Product
FlexTable
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-24
Advisory published
2026-05-25
Advisory updated
2026-07-24

Who should care

WordPress site administrators using the FlexTable plugin, security teams managing WordPress installations, and organizations with low-privileged user accounts that have access to WordPress admin interfaces.

Technical summary

The FlexTable plugin for WordPress, developed by WPPOOL, contains a Missing Authorization vulnerability (CWE-862) affecting versions through 3.24.0. The vulnerability allows attackers with low-level authenticated access to exploit incorrectly configured access control security levels. The attack requires network access but no user interaction, with a primary impact to data integrity. The CVSS 3.1 base score is 4.3 (Medium severity).

Defensive priority

medium

Recommended defensive actions

  • Review and update FlexTable plugin to version 3.24.1 or later if available
  • Verify plugin access control configurations in WordPress admin
  • Monitor for unauthorized table modifications or access attempts
  • Apply principle of least privilege for WordPress user accounts
  • Review Patchstack advisory for specific fixed version confirmation

Evidence notes

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts integrity only. The weakness is classified as CWE-862 (Missing Authorization). The vendor attribution is marked as low confidence with 'Unknown Vendor' in source data, though Patchstack identifies WPPOOL as the vendor.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-24582 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-24582

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-24582 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24582

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.