CVE-2026-11781 Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX
Low-privilege users can access sensitive non-public content via an unsecured AJAX search feature in the Adminify WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11781?
CVE-2026-11781 is a low-severity vulnerability in Unknown Adminify, published on 2 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.
Which versions are affected by CVE-2026-11781?
How do I fix CVE-2026-11781?
No fix has been published for CVE-2026-11781 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11781 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11781 exists.
Sources
Also known as GHSA-rx4r-gfpx-w668.