Unauthenticated Access Control Issue in All-In-One Intranet Plugin by Patchstack
CVE-2026-54837

7.5HIGH

Key Information:

Vendor

WordPress
Status
Intranet & Private Site – All-in-one Intranet
Vendor
CVE Published:
26 June 2026

What is CVE-2026-54837?

The All-In-One Intranet plugin for WordPress has been found to contain an unauthenticated broken access control vulnerability that affects versions up to 1.8.1. This issue allows unauthorized users to gain access to sensitive information, potentially compromising the security of intranet and private sites. It is crucial for site administrators using this plugin to apply the necessary updates to ensure robust security and protect user data from unauthorized access.

Affected Version(s)

Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1

References

https://patchstack.com/database/wordpress/plugin/all-in-o...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dodoh4t | Patchstack Bug Bounty Program
.