Authorization Bypass in OpenStation Plugin for WordPress

CVE-2026-109592

What is CVE-2026-109592?

The OpenStation plugin for WordPress is susceptible to an authorization bypass that allows authenticated users, including those with minimal permissions, to alter the positioning and metadata of other users' placements. This flaw arises from the plugin's failure to adequately confirm user permissions, paving the way for exploitation through its save-openstation AJAX endpoint. For an attacker to exploit this vulnerability, an orphaned placement state must first be established, which naturally occurs during the plugin's trash cascade process. This issue poses significant risks as it can lead to unauthorized access and manipulation of sensitive content within a WordPress site.

References