CVE-2026-9376
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An improper authorization vulnerability has been found in JPress up to version 1.0.3 in the UCenter Article Submission endpoint. Manipulation of id/userId arguments can lead to unauthorized access. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized access to article publishing functions, potentially leading to data leakage or content modification.
Recommendation
Update JPress to the latest version or apply a temporary fix such as server-side permission validation.
Other vulnerabilities in JPress
See all- CVE-2021-45807Critical
JPress v4.2.0 is vulnerable to remote code execution via the doUploadAndInstall function in the _AddonController. An attacker can upload a malicious file, leading to full server compromise.
- CVE-2021-46114High
JPress 4.2.0 is vulnerable to remote code execution (RCE) via the email template editing function in the admin panel. Attackers can inject malicious code into the template, leading to arbitrary command execution on the server.
- CVE-2021-46118High
JPress 4.2.0 is vulnerable to remote code execution via the email template editing function in the admin panel. An attacker can inject malicious code into the template, which gets executed when sending an email.
- CVE-2021-46116High
In jpress 4.2.0, a remote code execution vulnerability exists via the template installation function in _TemplateController#doInstall. Attackers can inject malicious code during template installation.
- CVE-2021-46115High
JPress 4.2.0 is vulnerable to remote code execution (RCE) via the template upload function in the admin panel. An attacker can upload a malicious template and execute arbitrary code on the server.
- CVE-2021-46117High
JPress 4.2.0 is vulnerable to remote code execution via the email template editing function in the admin panel. Attackers can inject malicious code into the template, leading to code execution on the server.
- CVE-2021-45808High
JPress v4.2.0 allows users to register an account by default. With the account, users can upload arbitrary files to the server.
- CVE-2021-45806High
In the JPress v4.2.0 admin panel, there is a function that allows template modification. Attackers can inject malicious code, leading to full site compromise.
Original NVD description (English source)
A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCenter Article Submission Endpoint. Executing a manipulation of the argument id/userId can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.