CVE-2026-104406: WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability
Published Oct 6, 2026
·Updated
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Affected Software
1 affected component
WordPress picu plugin<=3.10.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress picu pluginto a version that resolves this vulnerability.Fixed in 3.10.2
Event History
Oct 6, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges to exploit it.
2
Which installations are affected?
WordPress sites using the picu plugin version 3.10.1 or earlier are affected. The provided data does not identify a fixed version.
3
What is the likely impact?
The CVSS vector indicates network-reachable exploitation with low attack complexity and no user interaction. Successful exploitation may have limited effects on confidentiality, integrity, and availability.