CVE-2026-18364 PUBLISHED

Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

Assigner: WPScan
Reserved: 30.07.2026 Published: 23.09.2026 Updated: 23.09.2026

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.

Product Status

Vendor Unknown
Product zportals
Versions Default: unaffected
  • affected from 0 to 6.4.2 (excl.)

Credits

  • Erwan LR (WPScan) finder
  • WPScan coordinator

References

Problem Types

  • CWE-862 Missing Authorization CWE