Unauthorized Data Modification in 24liveblog Plugin for WordPress

CVE-2026-9184

What is CVE-2026-9184?

The 24liveblog plugin for WordPress contains a vulnerability that allows authenticated attackers with author-level access and above to perform unauthorized modifications of user data. This issue arises from a missing capability check in the update_lb24_token() AJAX function, which fails to validate user permissions and the associated user ID. As a result, attackers can overwrite critical user metadata, including tokens and identifiers, potentially compromising the security and integrity of the plugin's integration with the 24liveblog service. Users are encouraged to update to the latest version to mitigate this risk.

References