Vulnerability in Adminify
CVE-2026-11781
The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.
EPSS: 0.002 (8.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Unknown Adminify — versions 0
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-11781?
- CVE-2026-11781 is a low-severity vulnerability in Adminify, classified under CWE-200 INFORMATION EXPOSURE. CVSS score: 2.7/10. Published 2026-07-02.
- How severe is CVE-2026-11781?
- Low severity. CVSS v3 base score is 2.7 out of 10.