CVE-2026-102915: WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Published Oct 6, 2026
·Updated
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
Affected Software
1 affected component
WPO365 WPO365 WordPress plugin<=44.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPO365 pluginto a version that resolves this vulnerability.Fixed in 45.0
Event History
Oct 6, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Subscriber-level privileges in WordPress. The vulnerability does not require user interaction and is remotely reachable.
2
What is the potential impact?
Successful exploitation can expose highly confidential information and cause limited integrity impact. The scope is changed, meaning the vulnerable plugin may affect resources beyond its own security authority.
3
Which versions are affected?
WPO365 versions up to and including 44.1 are affected. The provided data does not identify a fixed version.