CVE-2026-111396

{
  "etk_id": "ETK-2026-2262",
  "cve_id": "CVE-2026-111396",
  "display_id": "CVE-2026-111396",
  "ghsa_id": "GHSA-ghh3-46wv-4fmv",
  "euvd_id": "EUVD-2026-102866",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Advanced Post Manager",
  "summary": "Advanced Post Manager versions through 4.5.6 contain an authorization control flaw. An authenticated attacker may be able to perform actions beyond their intended permissions, potentially affecting site integrity or availability.",
  "mitigation": "Disable the plugin or restrict its use to trusted, least-privileged accounts until the vendor publishes an update. Review plugin-related roles and remove unnecessary user access.",
  "vendor": "Liquid Web / StellarWP",
  "product": "Advanced Post Manager",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.5.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "advanced-post-manager",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.00891185,
  "t0_at": "2026-10-16T12:54:50.256000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T02:06:46.596918+00:00",
      "days": 4.549957649513889,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T12:54:50.256000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T12:54:50.256000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T12:54:50.256000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111396"
    }
  }
}