CVE-2026-109592
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The OpenStation plugin for WordPress (all versions up to and including 1.1.16) is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to modify arbitrary other users' placement rows and read serialized metadata. Exploitation requires at least one orphaned placement to exist and the attacker to self-enable OpenStation.
Risk Assessment
An attacker with a Subscriber account can modify other users' data and read sensitive metadata, potentially leading to data integrity and confidentiality breaches.
Recommendation
Update the OpenStation plugin to a version later than 1.1.16. Consider restricting access to the save-openstation endpoint for low-privilege users.
Other vulnerabilities in OpenStation WordPress Plugin
Original NVD description (English source)
The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary other users' placement rows (position, sort order, parent folder, and meta) and read serialized metadata — including title, permalink, and post status — of the entities those orphaned placements reference. Exploitation requires at least one orphaned placement to exist — a state produced naturally by the plugin's own trash cascade, which marks a parent folder as trashed while leaving child placements' parent_id intact — and the attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability held by every default WordPress role. This was also independently found by the OpenStation team.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS