Inadequate Permission Checks in WPZOOM Portfolio Lite WordPress Plugin
CVE-2026-110514
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110514?
The WPZOOM Portfolio Lite plugin for WordPress has a critical oversight in its permission management. Prior to version 1.4.34, the plugin fails to verify if a user has the appropriate permissions to edit a post before allowing changes to its type and order. This flaw enables users with contributor privileges and higher to alter any post or page, converting it into a portfolio item. As a result, these posts are removed from their original listings and URLs, potentially disrupting site organization and user navigation.
Affected Version(s)
WPZOOM Portfolio Lite 0 < 1.4.34
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.