Progress Planner: Broken access control in WordPress plugin

Summary

The WordPress plugin Progress Planner up to and including version 1.10.0 contains a broken access control flaw (CWE-862). An attacker with a Subscriber account, the lowest WordPress role, can reach functions or data that should be restricted. The CVSS score of 8.8 comes from the CNA and CISA-ADP records, as NVD analysis was still pending at the time of writing. No confirmed exploitation was found.

Affected

• Progress Planner WordPress plugin 1.10.0 and earlier

Fixed in

• Version 1.10.1 (according to the CVE record and Patchstack)
• The vendor changelog for 1.10.1 mentions hardened capability and permission checks but does not name this CVE.
• The free plugin has reached end of support, so no further fixed versions are known.

Workaround

• No vendor workaround known.
• Restrict open registration, review the default role and check existing Subscriber accounts (general hardening, not a vendor recommendation).
• Remove the plugin if an update to 1.10.1 is not possible.

Exploitation

• No evidence of exploitation in the wild found.
• CISA-ADP marks the issue as not automatable. Patchstack rates it high priority and expects exploitation.
• No public proof of concept found. NVD status is deferred.

Our recommendation

• Inventory all WordPress sites for Progress Planner.
• Update any site at 1.10.0 or earlier to 1.10.1 immediately, and prioritise sites with open registration.
• Plan replacement of the free plugin, as it no longer receives updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (CISA ADP) raw.githubusercontent.com
• Patchstack advisory for CVE-2026-62072 patchstack.com
• Vendor plugin page and changelog (WordPress.org) wordpress.org
• Strix mirror of CVE-2026-62072 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:24.