What is GHSA-xqw2-vwjg-w56m?

GHSA-xqw2-vwjg-w56m is a security advisory published by GitHub Security Advisories with High severity. The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check...

Which CVE IDs does GHSA-xqw2-vwjg-w56m cover?

GHSA-xqw2-vwjg-w56m covers the following CVE IDs: CVE-2026-87842. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xqw2-vwjg-w56m?

GHSA-xqw2-vwjg-w56m has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-xqw2-vwjg-w56mHighCVSS 7.5

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check...

Vendor

GitHub Security Advisories

Published

September 12, 2026

Last Modified

September 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-87842 →

📋 Description

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87842
https://wpscan.com/vulnerability/fb0cafdc-d1d5-4cad-852e-b0d569ae4469
https://github.com/advisories/GHSA-xqw2-vwjg-w56m