Executive brief
WP-Stateless is a WordPress plugin for managing static file storage and delivery. A flaw in versions up to 4.4.1 allows low-privilege subscriber accounts to change critical site settings, such as disabling security features or altering configurations. This could result in unauthorized modifications to website functionality and security posture.
Technical details
The vulnerability is a broken access control flaw in WP-Stateless plugin versions up to 4.4.1 that allows subscriber-level users to modify plugin settings. The root cause involves insufficient capability checks on settings-change operations, enabling unauthenticated or low-privilege users to alter configurations that should be restricted to administrators. Attack precondition requires subscriber-level access to the WordPress installation. An attacker with such access can change settings to disable security features, lock out administrators, or alter static file storage configuration. The vulnerability was patched in version 4.4.2.
Affected products
- WP-Stateless WP-Stateless <=4.4.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Version 4.4.2 released