CVE-2026-107887
Last modified
CVE-2026-107887 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Advanced Twenty Seventeen | <= 1.3.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-107887?
How severe is CVE-2026-107887?
How do I fix CVE-2026-107887?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107868Unauthenticated Bypass Vulnerability in YITH WooCommerce Pro…5.3
- CVE-2026-107869Missing Authorization vulnerability in WP Desk Flexible Subs…4.3
- CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3
- CVE-2026-107870Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaust…5.5
- CVE-2026-107886OpenPrinting CUPS before 2.4.20 contains a double-free in pr…6.5
- CVE-2026-107888OpenPrinting CUPS before 2.4.20 contains a NULL pointer dere…5.5
- CVE-2026-107889A flaw was found in the login theme rendering component of K…5.5
- CVE-2026-10789A maliciously crafted webpage, when visited by a user with A…9.6
- CVE-2026-107890OpenPrinting CUPS before 2.4.20 contains a NULL pointer dere…5.5
- CVE-2026-107894V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-b…7.8
- CVE-2026-107895V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of…7.8
Are you affected by CVE-2026-107887?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST