CVE-2026-4124

OVERVIEW The Ziggeo WordPress plugin versions up to 3.1.1 contains a missing authorization vulnerability in its AJAX handler. Although the handler implements nonce verification, it fails to perform capability checks, allowing authenticated users to execute administrative functions without proper permissions. The vulnerability exposes the nonce to all logged-in users, enabling Subscriber-level accounts and above to modify critical settings including translations, event templates, SDK applications, and notification configurations. SEVERITY This vulnerability has a CVSS 3.1 score of 5.4 MEDIUM with a network-based attack vector requiring low complexity and user authentication (PR:L). The impact is limited to integrity and availability concerns with no confidentiality breach. An authenticated attacker with minimal privileges can manipulate administrative options through wp_ajax handlers, though the attack requires a valid user account and session. The FAUCET risk score of 41.0/100 indicates moderate concern within the broader vulnerability landscape. EXPLOITATION STATUS Currently, this vulnerability shows no signs of active exploitation. It does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on public hot-list tracking systems. The EPSS score of 0.00061 suggests minimal probability of exploitation in the wild compared to peer vulnerabilities. No publicly disclosed exploit code is documented, though the straightforward nature of the authorization bypass makes exploitation technically feasible for anyone with authenticated access to the WordPress installation.