CVE-2026-104406
HighCVSS 7.3Summary
picu plugin in versions up to and including 3.10.1 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
Risk Assessment
An unauthenticated attacker can bypass access control mechanisms and perform unauthorized operations, potentially compromising data security.
Recommendation
Update the picu plugin to a version newer than 3.10.1 that contains the fix for this vulnerability.
Other vulnerabilities in picu
See all- CVE-2026-104395High
picu plugin in versions up to and including 3.10.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-57387High
The picu WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects all versions up to and including 3.5.1.
Original NVD description (English source)
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS