CVE-2026-1984: Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepabuilder' meta key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ibtana – Ecommerce Product Addonsto a version that resolves this vulnerability.Fixed in 0.4.7.7 - Configuration
Modify the 'iepa_use_gt_editor' AJAX handler to perform a proper WordPress capability check (missing in versions up to and including 0.4.7.7) so only authorized users can update/delete post meta for the 'iepa_builder' meta key.
Ibtana – Ecommerce Product Addons (WordPress AJAX action: 'iepa_use_gt_editor') capability check for authenticated users (Subscriber+) = Add/enable capability verification before processing the 'iepa_use_gt_editor' AJAX request (block requests lacking required capability).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the WordPress site. Accounts with Subscriber-level access or any higher role can exploit the affected AJAX action.
What can an attacker change?
The attacker can update or delete arbitrary post meta entries through the iepa_builder meta key. The provided data does not indicate that post content, user accounts, or other metadata keys can be modified through this issue.
Are sites with only unauthenticated visitors exposed?
The issue requires authentication, so an unauthenticated remote visitor cannot exploit it directly. Sites that allow registration or otherwise provide Subscriber or higher accounts have a relevant exposure path.
What versions are affected?
All versions through 0.4.7.7, including 0.4.7.7, are affected. No fixed version is identified in the provided data.