CVE-2026-34903

CVE-2026-34903 is a Missing Authorization vulnerability affecting OceanWP Ocean Extra plugin versions through 2.5.3 that exploits incorrectly configured access control security levels. The vulnerability allows authenticated users to perform unauthorized actions due to improper authorization checks. The vulnerability carries a CVSS score of 5.4 (Medium severity) with a network-based attack vector requiring low complexity and user authentication. The attack has limited impact, resulting in integrity and availability degradation rather than confidential data exposure. The EPSS score of 0.00013 indicates minimal prevalence among current CVE threats. There is currently no active exploitation of this vulnerability in the wild, as evidenced by its inactive status on the KEV catalog and absence from threat intelligence hot lists. Community attention appears minimal given its moderate FAUCET risk score of 41.0 out of 100, suggesting organizations should prioritize patching higher-risk vulnerabilities first while still planning to upgrade Ocean Extra to versions beyond 2.5.3 during routine maintenance cycles.