blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-11781

LOW 2.7 CVSS 3.1
Published
July 2, 2026
Last modified
July 2, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Description

The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.

Affected WordPress components

  • Adminify – White Label, Admin Menu Editor, Login Customizer Plugin · adminify
    Confirmed match Active
    Before 4.2.10
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Adminify — Before 4.2.10

References

  • wpscan.com https://wpscan.com/vulnerability/0aa18fe0-2d64-45dc-9eab-9587d63853be/
  • nvd.nist.gov Official NVD record