CVE-2026-65531
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Qubely plugin for WordPress up to version 1.8.14 contains an Unauthenticated Broken Access Control vulnerability.
Risk Assessment
An unauthenticated attacker can gain unauthorized access to administrative functions, potentially leading to modification of settings or data.
Recommendation
Update the Qubely plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in Qubely
See all- CVE-2026-39638Medium
The Qubely plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2025-58663Medium
The Qubely plugin for WordPress has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 1.8.14.
- CVE-2025-58249Medium
The Qubely plugin (versions up to and including 1.8.14) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows retrieval of embedded sensitive data. An attacker may gain access to information that should not be disclosed.
Original NVD description (English source)
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS