Is CVE-2026-62028 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62028 being exploited in the wild.

How severe is CVE-2026-62028?

Medium severity, with a CVSS score of 5.4, published 9 October 2026.

Which products and versions are affected?

bPlugins Before After Image Comparison through 1.1.21.

Is there a fix for CVE-2026-62028?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-62028 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-62028?

Check whether you run bPlugins Before After Image Comparison at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62028: bPlugins Before After Image Comparison broken access control

CVE-2026-62028 · Severity: medium · CVSS 5.4 · Published 2026-10-09

The Before After Image Comparison plugin for WordPress is used to display side-by-side image comparisons on website pages. A broken access control flaw allows WordPress users with lower privileges (such as subscribers) to access pages and perform actions they should not be authorized to do, potentially exposing sensitive data or allowing unauthorized modifications. There is currently no official patch available for this issue.

Vendors: bPlugins.

Quick answers

Is CVE-2026-62028 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62028 being exploited in the wild.
How severe is CVE-2026-62028?: Medium severity, with a CVSS score of 5.4, published 9 October 2026.
Which products and versions are affected?: bPlugins Before After Image Comparison through 1.1.21.
Is there a fix for CVE-2026-62028?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-62028 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-62028?: Check whether you run bPlugins Before After Image Comparison at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin through version 1.1.21 suffers from broken access control (CWE-639), allowing users with subscriber-level privileges to access resources and perform actions without proper authorization checks. The vulnerability is exploitable with network access and requires only subscriber-level authentication on a WordPress site running the affected plugin. An attacker gains the ability to view restricted data or execute unauthorized actions depending on the plugin's functionality.

Affected products

bPlugins Before After Image Comparison through 1.1.21

Timeline

2026-08-16: disclosed
2026-10-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.