CVE-2026-62072

HighCVSS 8.8

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

The Progress Planner plugin versions up to 1.10.0 contain a Broken Access Control vulnerability from the subscriber role. This means a low-privileged user can gain unauthorized access to functions or data.

Risk Assessment

The risk includes privilege escalation, unauthorized access to sensitive data or functions, potentially leading to system integrity compromise.

Recommendation

It is recommended to update the Progress Planner plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Progress Planner

CVE-2026-28116Medium
The Progress Planner plugin for WordPress up to version 1.9.0 contains a stored XSS vulnerability due to improper input neutralization during page generation.

Original NVD description (English source)

Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS