CVE-2026-93513
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The SiteSkite plugin in versions up to 2.1.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows a user with the Contributor role to access objects they should not have permission to. The lack of proper permission verification on object references enables manipulation of identifiers to gain unauthorized access.
Risk Assessment
A low-privileged user (Contributor) can access data or functions reserved for authorized users, potentially leading to information disclosure or unauthorized operations. This affects the confidentiality and integrity of resources protected by the plugin.
Recommendation
Update the SiteSkite plugin to a version later than 2.1.7 that contains the fix for this vulnerability. If updating is not possible, consider disabling the plugin until the patch can be applied.
Other vulnerabilities in SiteSkite
See all- CVE-2026-81805High
The SiteSkite plugin in versions up to 2.1.5 contains a Privilege Escalation vulnerability. An unauthenticated attacker can elevate their privileges.
- CVE-2026-96349Critical
The SiteSkite plugin in versions up to and including 2.1.8 contains an unauthenticated remote code execution (RCE) vulnerability. An attacker can execute arbitrary code on the server without logging in.
Original NVD description (English source)
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS