CVE-2026-106603

MediumCVSS 6.5

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HollerBox: from n/a through 2.3.14.

Risk Assessment

An attacker may gain access to functions or data they are not authorized for, potentially leading to unauthorized changes on the WordPress site.

Recommendation

Update the HollerBox plugin to a version later than 2.3.14. Review and correct access control configuration on the site.

Other vulnerabilities in HollerBox

CVE-2026-48885High
Versions of HollerBox up to 2.3.10.1 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS