Executive brief
The Civi Framework plugin for WordPress, which provides core functionality for certain themes and site features, contains a security flaw in its access control mechanisms. This vulnerability allows unauthenticated individuals to perform actions that should be restricted to authorized users. While the impact is currently rated as medium, it could allow unauthorized changes to site settings or data depending on the specific functions exposed.
Technical details
The Civi Framework plugin for WordPress (versions <= 2.2.0) suffers from a broken access control vulnerability (CWE-862: Missing Authorization). The flaw exists because the plugin fails to properly validate authorization, authentication, or nonce tokens before executing certain functions. A remote, unauthenticated attacker can exploit this by sending crafted requests to the vulnerable endpoints, potentially allowing them to modify site configurations or perform other unauthorized actions. As of the advisory date, no official patch has been released.
Affected products
- uxper Civi Framework <= 2.2.0
Timeline
- 2026-02-09: other: Vulnerability reported by researcher Tran Nguyen Bao Khanh
- 2026-07-23: disclosed: Vulnerability published by Patchstack and NVD