Is CVE-2026-62134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62134 being exploited in the wild.

How severe is CVE-2026-62134?

Medium severity, with a CVSS score of 4.3, published 11 September 2026.

Which products and versions are affected?

Brainstorm Force Starter Templates <=4.7.5.

Is there a fix for CVE-2026-62134?

A patch was published on 2026-09-10: Patched in version 4.7.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62134 attacked?

It is attacked over the network.

Am I affected by CVE-2026-62134?

Check whether you run Brainstorm Force Starter Templates at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62134: Starter Templates contributor IDOR vulnerability

Q: Is there a fix for CVE-2026-62134?

A patch was published on 2026-09-10: Patched in version 4.7.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62134 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-62134?

Check whether you run Brainstorm Force Starter Templates at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62134 · Severity: medium · CVSS 4.3 · Published 2026-09-11

The Starter Templates WordPress plugin contains an access control flaw that allows contributors (low-privilege users) to view or access data belonging to other users by manipulating object identifiers in URLs. While the vulnerability requires authenticated contributor-level access, it could expose sensitive site data or configuration information created by other users, potentially compromising confidentiality or providing reconnaissance for further attacks.

Technologies: Brainstorm Force Starter Templates. Vendors: Brainstorm Force.

Quick answers

Is CVE-2026-62134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62134 being exploited in the wild.
How severe is CVE-2026-62134?: Medium severity, with a CVSS score of 4.3, published 11 September 2026.
Which products and versions are affected?: Brainstorm Force Starter Templates <=4.7.5.
Is there a fix for CVE-2026-62134?: A patch was published on 2026-09-10: Patched in version 4.7.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62134 attacked?: It is attacked over the network.
Am I affected by CVE-2026-62134?: Check whether you run Brainstorm Force Starter Templates at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the Starter Templates plugin versions up to 4.7.5. A contributor-level authenticated user can modify ID parameters in URLs to access objects or data belonging to other users, bypassing authorization checks. The attack requires authentication as a contributor role but does not require additional user interaction. An attacker can enumerate and retrieve data that should be restricted to its owner, such as templates, configurations, or metadata. The issue has been patched in version 4.7.6 and later.

Affected products

Brainstorm Force Starter Templates <=4.7.5

Timeline

2026-08-28: disclosed: Reported to Patchstack
2026-09-10: advisory: Published by Patchstack
2026-09-10: patched: Patched in version 4.7.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.