CVE-2026-15606

CVE-2026-15606 is a CBC bit-flipping vulnerability in a WordPress plugin's custom authorization token system. The plugin encrypts a Current-User token and feeds it back into authorization decisions—treating encryption as if it provided integrity. It provides neither. When CBC-encrypted tokens contain predictable plaintext structure (like user IDs and roles), an attacker with valid ciphertext can flip specific bits in the ciphertext to systematically manipulate the decrypted plaintext, forging authorization for arbitrary user actions. A subscriber who can access the Edit User form has everything they need: a valid encrypted token and sufficient plaintext predictability to construct the bit-flipping oracle. The attack chain compresses to subscriber → full site compromise through a single token exfiltration and manipulation step. The remediation is straightforward but must be applied correctly. Replace the unauthenticated CBC encryption with authenticated encryption—either AES-GCM or AES-CBC with a separate HMAC-SHA256 computed over the ciphertext. The critical implementation detail: the HMAC must cover the ciphertext, not the plaintext, and must be verified before any decryption or authorization decision occurs. For existing deployments, treat any exposed token as compromised and force re-authentication. This isn't a patch-and-continue scenario; the token format itself is dangerous. The deeper pattern here matters more than this specific CVE. This exact failure—encrypted tokens used for authorization without MAC verification—has appeared in PHP applications for over twenty years. Each instance was CVE'd, documented, and recommended against. The knowledge exists in security literature but doesn't reach the developers building these systems, who find outdated guidance in Stack Overflow answers and tutorial code. If you maintain plugins that use encryption for authorization purposes, audit them for this pattern. The code smell is simple: encrypted data influencing access decisions without a validated MAC. That's your triage criterion.

Reviewed through automated stages and approved by a human before publication.