CVE-2026-66677

Broken Authentication vulnerability in Leyka plugin versions up to 3.32.3, exploitable by a user with Subscriber role. A low-privileged user can bypass authentication mechanisms and gain unauthorized access.

Risk of unauthorized access to other users' accounts or administrative functions, potentially leading to system security compromise.

Update the Leyka plugin to the latest version that includes a fix eliminating the Broken Authentication vulnerability.