CVE-2026-16948

This CVE exposes a compounding security failure in a WordPress plugin where two independent protection mechanisms were simultaneously bypassed—an AJAX endpoint missing capability checks AND nonces exposed to low-privilege users. The CVSS 8.1 score conflates failures with very different exploitability profiles, and understanding that distinction is critical for defenders. The missing capability check is the direct vulnerability: any authenticated Subscriber could invoke an administrative action without authorization. However, the exposed nonce is the architectural collapse that transforms this from a targeted bug into a systemic risk. Once an attacker can extract a valid nonce from an admin page, they gain a reusable template to probe every other AJAX endpoint in the plugin without triggering anomalies. The discovery cost drops from sustained offensive operation to copy-paste from page source. This changes the threat model from 'find specific endpoints' to 'enumerate the entire plugin surface.' The presence of nonces without capability checks reveals something specific about the development workflow: the developer understood enough to add security scaffolding (the nonce appears in every WordPress AJAX tutorial) but not enough to implement actual authorization. This is copy-paste development—taking an AJAX handler skeleton from a tutorial, changing the action name, and shipping it. The nonce created a false sense of security while the invisible authorization logic was never added. For defenders, audit every other AJAX endpoint in this plugin against the same pattern: nonce present but current_user_can() absent. Assume other endpoints have the same gap. Beyond patching the reported endpoints, the admin template layer that exposed the nonces in the first place must be restructured—bolt-on capability checks on reported endpoints treat symptoms while the architectural disease persists in how the plugin handles privilege separation. Static analysis rules flagging current_user_can() absence in AJAX callbacks would catch this class of bug at development time.

Reviewed through automated stages and approved by a human before publication.