CVE-2026-125858: WordPress CleverReach® WP plugin <= 1.5.26 - Broken Access Control vulnerability
Published Nov 13, 2026
·Updated
Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26.
Affected Software
1 affected component
CleverReach CleverReach WP<=1.5.26
Event History
Nov 13, 2026
CVE Published
via MITRE·03:08 PM
Data Sourced
via MITRE·03:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and can exploit the issue remotely over the network without user interaction.
2
Which plugin versions are affected?
CleverReach® WP versions through 1.5.26 are affected. The available data does not identify a fixed version.
3
What impact could successful exploitation have?
Successful exploitation may affect confidentiality, integrity, and availability at a low impact level, according to the CVSS vector.