CVE-2026-128834: WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability

Q: Which Spectra versions are affected?

The issue affects Spectra versions through 2.20.5. The available data does not identify a fixed version.

Q: Can this be exploited remotely without an account?

The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. This suggests an unauthenticated remote attacker may be able to exploit the issue.

Q: What is the expected impact if exploited?

The CVSS vector indicates low confidentiality impact and no integrity or availability impact. The vulnerability is categorized as broken access control caused by missing authorization and incorrectly configured access-control security levels.

Published Nov 13, 2026

Updated

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5.

Affected Software

1 affected component

Brainstorm Force Spectra<=2.20.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.20.6

Event History

Nov 13, 2026

CVE Published

via MITRE·12:51 PM

Data Sourced

via MITRE·12:51 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Spectra versions are affected?

The issue affects Spectra versions through 2.20.5. The available data does not identify a fixed version.

Can this be exploited remotely without an account?

The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. This suggests an unauthenticated remote attacker may be able to exploit the issue.

What is the expected impact if exploited?

The CVSS vector indicates low confidentiality impact and no integrity or availability impact. The vulnerability is categorized as broken access control caused by missing authorization and incorrectly configured access-control security levels.

CVE-2026-128834: WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Spectra versions are affected?

Can this be exploited remotely without an account?

What is the expected impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Which Spectra versions are affected?

Can this be exploited remotely without an account?

What is the expected impact if exploited?