CVE-2026-34903
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Ocean Extra plugin for WordPress (through version 2.5.3) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could bypass authorization mechanisms and perform actions reserved for privileged users, potentially leading to unauthorized changes on the site.
Recommendation
Update the Ocean Extra plugin to the latest version and review the permission configuration in the WordPress site.
Other vulnerabilities in Ocean Extra
See all- CVE-2026-86803Medium
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2025-9499Medium
The Ocean Extra plugin for WordPress is vulnerable to stored XSS via the 'oceanwp_library' shortcode in versions up to and including 2.4.9 due to insufficient sanitization and escaping of user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.
Original NVD description (English source)
Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS