Skip to content

Improve GHSA-5cfw-whc5-jqgh: add affected/patched version range #9590

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
agencyhub wants to merge 1 commit into
base: agencyhub/advisory-improvement-9590
Choose a base branch
from
+27 −3
Open

Improve GHSA-5cfw-whc5-jqgh: add affected/patched version range #9590

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions advisories/unreviewed/2026/07/GHSA-5cfw-whc5-jqgh/GHSA-5cfw-whc5-jqgh.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5cfw-whc5-jqgh",
"modified": "2026-07-30T06:32:35Z",
"modified": "2026-09-17T00:00:00Z",
"published": "2026-07-30T06:32:35Z",
"aliases": [
"CVE-2026-14356"
],
"summary": "FleekDash V2 <= 2.6.2.2 - Missing Authorization to Arbitrary User Email/Password Change",
"details": "The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any WordPress user, including administrators, enabling full account takeover and complete site compromise. The public /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the site's users_can_register setting, enabling unauthenticated attackers to self-provision the required credentials and nonce in a single prior request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wpackagist-plugin/fleekdash"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.2.5"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.6.2.2"
}
}
],
"references": [
{
"type": "ADVISORY",
Expand All @@ -37,4 +61,4 @@
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T05:16:32Z"
}
}
}