CVE-2026-42707
MediumCVSS 4.3Summary
The HivePress Claim Listings plugin through version 1.1.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.
Risk Assessment
An unauthorized party may perform actions reserved for other roles, potentially leading to data modification or disclosure. The risk affects sites with the vulnerable plugin version.
Recommendation
Update the HivePress Claim Listings plugin to a version later than 1.1.4. Verify the permission configuration on the site.
Other vulnerabilities in HivePress Claim Listings
See all- CVE-2025-60123Medium
The HivePress Claim Listings plugin for WordPress in versions up to and including 1.1.3 contains a Missing Authorization vulnerability. It enables exploitation of incorrectly configured access control security levels.
- CVE-2025-60122Medium
The HivePress Claim Listings plugin for WordPress in versions up to and including 1.1.4 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS