CVE-2026-94498

MediumCVSS 6.5

Published: 23/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Broken Access Control vulnerability in the AppMySite plugin in versions up to and including 3.15.4. The vulnerability can be exploited by an unauthenticated attacker.

Risk Assessment

An unauthenticated attacker can bypass access control mechanisms and perform unauthorized actions. This may lead to data disclosure or configuration modification.

Recommendation

Update the AppMySite plugin to a version newer than 3.15.4. Consider temporarily disabling the plugin if an update is not possible.

Other vulnerabilities in AppMySite

CVE-2025-58679Medium
The AppMySite plugin (versions up to 3.15.0) has a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS