CVE-2026-123470
📛 CVE Title
WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability
Description
Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- MEDIUM
- CVSS score
- 4.3 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Effective score
- 4.3 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-862 - Reserved
- 2026-11-06
- Published
- 2026-11-07 10:41 UTC
- Last updated
- 2026-11-07 10:42 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123470.json
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119131
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| HivePress | HivePress |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:ctiwatch.com
CVE-2026-123470 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors. Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
2026-11-08 11:32 UTC -
web:cvetodo.com
CVE-2026-123470 is a CVSS 4.3 Missing Authorization vulnerability in HivePress. Full technical analysis, mitigations , and exploit status — updated in real time.
2026-11-08 11:32 UTC -
web:cyberupdates365.com
Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.
2026-11-08 11:32 UTC -
web:radar.offseq.com
CVE-2026-123470 is a missing authorization vulnerability in HivePress versions prior to 1.8.2. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data.
2026-11-08 11:32 UTC -
web:support.sap.com
On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.
2026-11-08 11:32 UTC -
web:vulners.com
CVE-2026-123470 🗓️ 07 Nov 2026 02:41:57 Reported by Patchstack Type cve 🔗 web.nvd.nist.gov 👁 6 Views
2026-11-08 11:32 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-11-08 11:32 UTC -
web:www.openhands.dev
Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.
2026-11-08 11:32 UTC -
web:www.rapid7.com
CVE-2026-123470 : HivePress: Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access…. View severity, references, and remediation details from Rapid7.
2026-11-08 11:32 UTC -
web:www.tenable.com
Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.
2026-11-08 11:32 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-123470.json.
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress",
"product": "HivePress",
"vendor": "HivePress",
"versions": [
{
"changes": [
{
"at": "1.8.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.8.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "luu | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-07T10:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects HivePress: from n/a through 1.8.1.</p>"
}
],
"value": "Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T10:42:59.418Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.2)."
}
],
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.2)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-123470",
"datePublished": "2026-11-07T10:41:57.797Z",
"dateReserved": "2026-11-06T00:25:34.012Z",
"dateUpdated": "2026-11-07T10:42:59.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}