Access Control Flaw in YMC Filter Plugin by WordPress
CVE-2026-16558
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 August 2026
Badges
What is CVE-2026-16558?
The YMC Filter plugin for WordPress, prior to version 3.12.8, contains a significant access control flaw. The plugin fails to properly sanitize and escape a layout builder setting when it is outputted on a public endpoint. Additionally, it lacks verification of object ownership during the saving process. This oversight enables users with Contributor roles and higher to inject malicious JavaScript, which can execute in the browsers of visitors who view an affected filter. This vulnerability poses a serious risk to both site administrators and end-users, as it could lead to unauthorized actions being performed on the website.
Affected Version(s)
YMC Filter 3.6.0 < 3.12.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.