WPSection WordPress plugin: Broken access control for Subscriber accounts
Summary
The WPSection WordPress plugin up to and including version 1.5.1 contains a broken access control flaw (CWE-862). A logged-in user with the lowest role, Subscriber, can reach functions that should be restricted, which can affect the integrity and availability of the site. The attack is possible over the network without user interaction, so the risk is highest on sites that allow open user registration.
Affected
- WPSection WordPress plugin by Rashid, versions up to and including 1.5.1
- Attack requires a Subscriber account
Fixed in
Unknown. No fixed version was found in the sources reviewed.
Workaround
- Deactivate or remove the WPSection plugin if it is not needed
- Restrict the Subscriber role so it cannot use WPSection functions, using a role or capability management plugin
- Disable or review open user registration
Exploitation
- No entry in the CISA KEV catalogue
- CISA SSVC: exploitation none, automatable no, technical impact partial
- EPSS score 0.00352 (low)
- No public proof of concept found; this does not rule one out
- Patchstack rates the issue as high priority and expects exploitation
Our recommendation
- Inventory all WordPress sites and check for WPSection and its exact version
- If WPSection is installed and no fix exists, deactivate it when it is not required
- Review or disable open Subscriber registration and check existing Subscriber accounts for unknown users
- Check the official wordpress.org page and the Patchstack advisory regularly for a fixed version and update as soon as one is available
- Monitor the NVD record, which is currently deferred
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-40777 app.opencve.io
- Rapid7 via Vulners vulners.com
- Strix CVE-2026-40777 www.strix.ai
- HOL Guard CVE-2026-40777 hol.org
- WordPress.org WPSection plugin page wordpress.org
- Wordfence threat intelligence WPSection www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:14.
Original description (NVD)
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.