CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions
Contributors can modify arbitrary WordPress options via AJAX actions, potentially locking administrators out of the site.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19840?
CVE-2026-19840 is a medium-severity missing authorization vulnerability in Unknown Notiqoo, published on 10 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
Weakness: CWE-863
Which versions are affected by CVE-2026-19840?
How do I fix CVE-2026-19840?
No fix has been published for CVE-2026-19840 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-19840 being exploited?
There is no known exploitation of CVE-2026-19840 in the wild and no public exploit code.
Sources
Also known as GHSA-xq47-g3qj-2hcj.