# CVE-2026-65453: motov.net Ebook Store broken access control

Source: https://junglewise.ai/threats/cve-2026-65453-motov-net-ebook-store-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65453 · Severity: medium · CVSS 5.3 · Published 2026-07-23

The Ebook Store plugin for WordPress, which allows site owners to sell and manage digital books, contains a security flaw in its access control mechanisms. An unauthenticated remote attacker can exploit this to perform unauthorized actions that should be restricted to administrators. While the impact is considered moderate, it could allow unauthorized changes to the store's configuration or data.

Technologies: [Motov.Net Ebook Store](https://junglewise.ai/threats/technologies/ebook-store). Vendors: [Motov.Net](https://junglewise.ai/threats/vendors/motov-net).

## Quick answers

**Is CVE-2026-65453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65453 being exploited in the wild.

**How severe is CVE-2026-65453?** Medium severity, with a CVSS score of 5.3, published 23 July 2026.

**Which products and versions are affected?** Motov.Net Ebook Store <= 6.19.

**Is there a fix for CVE-2026-65453?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65453 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65453?** Check whether you run Motov.Net Ebook Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Ebook Store plugin for WordPress (versions 6.19 and below) suffers from a broken access control vulnerability categorized as missing authorization (CWE-862). The flaw exists because the plugin fails to properly validate user permissions or implement sufficient nonce checks before executing certain functions. A remote, unauthenticated attacker can exploit this by sending crafted network requests to the affected site. This allows the attacker to perform actions that are intended for higher-privileged users, potentially modifying plugin settings or data. The issue is resolved in version 6.20.

## Affected products

- motov.net Ebook Store <= 6.19

## Timeline

- 2026-01-25: other: Reported by Nabil Irawan
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: disclosed: CVE published to NVD dataset

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-6-19-broken-access-control-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-6-19-broken-access-control-vulnerability-2?_s_id=cve)

## Related threats

- [motov.net Ebook Store sensitive data exposure](https://junglewise.ai/threats/cve-2026-59529-motov-net-ebook-store-sensitive-data-exposure)
- [motov.net Ebook Store broken access control](https://junglewise.ai/threats/cve-2026-65452-motov-net-ebook-store-broken-access-control)