Auth bypass in Radius314 Bread
CVE-2026-4792
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.006 (47.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/1c3b0fe6-796b-41c7-b989-43908…
- plugins.trac.wordpress.org/browser/bread/trunk/admin/class-bread-admin.php
- plugins.trac.wordpress.org/browser/bread/tags/2.9.10/admin/class-bread-admin.php
- plugins.trac.wordpress.org/browser/bread/trunk/includes/class-bread.php
- plugins.trac.wordpress.org/browser/bread/tags/2.9.10/includes/class-bread.php
Frequently asked questions
- What is CVE-2026-4792?
- CVE-2026-4792 is a medium-severity vulnerability in Radius314 Bread, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-09-19.
- How severe is CVE-2026-4792?
- Medium severity. CVSS v3 base score is 5.3 out of 10.