Executive brief
The 24liveblog plugin for WordPress, which allows websites to host live-blogging events, contains a security flaw that allows unauthorized users to modify plugin settings. An attacker with a basic contributor or author account could change the connection settings between the website and the 24liveblog service. This could lead to a hijacking of the live-blogging integration, potentially disrupting live coverage or redirecting service data to an account controlled by the attacker.
Technical details
The 24liveblog plugin for WordPress is vulnerable to a missing authorization check (CWE-862) within the update_lb24_token() AJAX function. While the function validates a nonce, it fails to verify if the requesting user has the appropriate administrative permissions or if the user_id being modified matches the current user. This allows authenticated attackers with author-level access or higher to overwrite critical user meta and site-wide options, including lb24_token, lb24_uid, and lb24_refresh_token. By exploiting this, an attacker can effectively hijack the plugin's integration with the 24liveblog service for any user, including administrators.
Affected products
- 24liveblog 24liveblog – live blog tool up to, and including, 2.2
Timeline
- 2026-06-24: disclosed: Vulnerability published by Wordfence and NVD.
References
- https://plugins.trac.wordpress.org/browser/24liveblog/trunk/plugin.php
- https://plugins.trac.wordpress.org/browser/24liveblog/trunk/plugin.php
- https://plugins.trac.wordpress.org/browser/24liveblog/trunk/plugin.php
- https://plugins.trac.wordpress.org/browser/24liveblog/trunk/plugin.php
- https://plugins.trac.wordpress.org/browser/24liveblog/trunk/src/init.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f22854-049a-4b4f-a448-13c416e0a6b7?source=cve