Missing Authorization Vulnerability in My Auctions Allegro by Wphocus
CVE-2026-116855

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
My Auctions Allegro
Vendor
CVE Published:
28 October 2026

What is CVE-2026-116855?

A missing authorization vulnerability exists in Wphocus My Auctions Allegro, which allows unauthorized users to exploit improperly configured access control settings. This issue affects all versions prior to 4.0.3 of the My Auctions Allegro Free Edition plugin. Attackers can gain access to restricted functionalities, posing a risk to the security of user data and transactions.

Affected Version(s)

My auctions allegro 0 <= 4.0.3

References

https://patchstack.com/database/wordpress/plugin/my-aucti...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ashv4ni | Patchstack Bug Bounty Program
.