CVE-2026-18364

MediumCVSS 4.3

Published: 23/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

7th percentile - higher than 7% of all known CVEs

Summary

The zportals WordPress plugin before version 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals plugin's stored integration settings.

Risk Assessment

Attackers can change integration settings, potentially leading to unauthorized configuration changes and security compromises.

Recommendation

Update the zportals plugin to version 6.4.2 or later, which includes the capability and nonce check fix.

Other vulnerabilities in zportals

CVE-2026-18365Medium
The zportals WordPress plugin before version 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.

Original NVD description (English source)

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS