Wordable WordPress plugin: Broken access control for Subscriber users
Summary
The Wordable plugin for WordPress, versions up to and including 8.2.10, contains a broken access control vulnerability (CWE-862). An authenticated user with the lowest default role, Subscriber, may be able to perform actions or access functions reserved for higher privileges. No user interaction is required, and the CVSS score is 8.1 with high confidentiality and integrity impact. No fixed version or vendor advisory is known yet.
Affected
- Wordable WordPress plugin up to and including 8.2.10
- Required privilege: Subscriber account
Fixed in
Unknown. No fixed version has been published as of the research date.
Workaround
- Deactivate the plugin if the content workflow allows it.
- Turn off open user registration, or set the default role to one with no content rights.
- Review and remove unneeded Subscriber accounts and check for unexpected ones.
- Monitor the Wordable changelog and the Patchstack entry for a fixed release.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- Not listed as known exploited (KEV: No).
- No public proof of concept found; this does not rule one out.
- EPSS is low (0.00326).
- Patchstack rates it high priority and expects exploitation.
Our recommendation
- Check whether the Wordable plugin is installed and which version is active.
- Deactivate the plugin on sites where it is not essential.
- Disable open registration and remove unneeded Subscriber accounts.
- Monitor the Patchstack and NVD entries and update as soon as a fixed version is published.
- Treat sites with open registration as high risk and sites with closed registration and trusted users as medium risk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack vulnerability entry CVE-2026-40801 patchstack.com
- OpenCVE CVE-2026-40801 app.opencve.io
- Strix CVE-2026-40801 www.strix.ai
- HOL Guard CVE-2026-40801 hol.org
- Vulners RAPID7 CVE-2026-40801 (EPSS) vulners.com
- Patchstack Wordable plugin overview patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:15.
Original description (NVD)
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.