Missing Authorization Vulnerability in Ziggeo Plugin for WordPress

CVE-2026-4124

What is CVE-2026-4124?

The Ziggeo plugin for WordPress displays a vulnerability that allows authenticated users to bypass authorization checks. This issue arises from the 'wp_ajax_ziggeo_ajax' handler, which only verifies a nonce and fails to check user capabilities through the 'current_user_can()' function. As a result, any authenticated user with Subscriber privileges or higher can perform various high-level operations, including manipulating translation strings, managing event templates, modifying SDK application settings, and altering notification settings. The nonce, which is visible to all logged-in users on every page, adds to the risk, enabling multiple administrative functions to be abused.

References