CVE-2026-112826: WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that exploitation can be performed over the network without authentication or user interaction. Sites using an affected version are exposed to unauthenticated remote attackers.

Q: What is the expected impact if exploitation succeeds?

The reported impact is limited to confidentiality, with a low confidentiality impact and no reported integrity or availability impact. The vulnerability is rated medium severity with a CVSS score of 5.3.

Published Oct 22, 2026

Updated

Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.

Affected Software

1 affected component

eLightUp Falcon – WordPress Optimizations & Tweaks<=2.12.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade eLightUp Falcon – WordPress Optimizations & Tweaks to a version that resolves this vulnerability.
Fixed in 2.12.1

Event History

Oct 22, 2026

CVE Published

via MITRE·06:52 AM

Data Sourced

via MITRE·06:52 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that exploitation can be performed over the network without authentication or user interaction. Sites using an affected version are exposed to unauthenticated remote attackers.

What is the expected impact if exploitation succeeds?