Authorization Bypass Vulnerability in Groundhogg HollerBox Plugin
CVE-2026-106603

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Hollerbox
Vendor
CVE Published:
8 October 2026

What is CVE-2026-106603?

The Groundhogg HollerBox plugin is vulnerable to an authorization bypass due to incorrectly configured access control mechanisms. This vulnerability allows attackers to manipulate user-controlled keys to gain unauthorized access to restricted areas or functionalities of the plugin. This issue affects all versions of HollerBox up to and including 2.3.14, posing significant risks to user data and application integrity.

Affected Version(s)

HollerBox 0 <= 2.3.14

References

https://patchstack.com/database/wordpress/plugin/holler-b...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

benzdeus | Patchstack Bug Bounty Program
.