CVE-2026-65554

Executive Summary

CVE-2026-65554 is a broken access control vulnerability in the AnsPress – Question and answer plugin version 4.4.4 for WordPress, discovered and reported by Patchstack. The flaw allows a subscriber-level authenticated user to perform unauthorized actions on the plugin's content management functions, bypassing the intended privilege checks. Successful exploitation compromises data integrity on affected WordPress sites, permitting low-privileged account holders to tamper with Q&A content, with a moderate availability impact potentially disrupting the site's core Q&A functionality.

Technical Analysis

The AnsPress plugin provides a full question-and-answer platform for WordPress, managing content created by site visitors, registered users, and moderators. The vulnerability stems from the absence of adequate authorization checks in content management routines. Specifically, the plugin fails to validate whether a request to modify Q&A content originates from a user with the necessary capabilities (e.g., administrator or editor role). The affected logic likely resides in handler functions registered to process form submissions or AJAX requests that perform actions such as deleting questions, changing answer acceptance status, or editing content attributes.

The NVD description labels this class as "Subscriber Broken Access Control," indicating that the authorization check is missing entirely rather than improperly implemented. A subscriber-level account, which in default WordPress is purely a content consumer with profile editing rights, can interact with the AnsPress plugin's submission handlers. Without a capability check (e.g., current_user_can()), the handler processes the request on behalf of the subscriber, granting them elevated privileges.

The attack surface is network-accessible over HTTP/HTTPS. The attack vector is network (AV:N), with low attack complexity (AC:L) — meaning no special conditions must exist for the exploit to succeed. The attacker needs only subscriber-level credentials (PR:L), which can be obtained by registering for a free account on sites that allow open registration, or by compromising a subscriber account. No user interaction is required (UI:N), and the scope is unchanged (S:U), meaning the vulnerability's impact is confined to the WordPress application and does not extend to other systems.

From a code perspective, the issue manifests in one of the plugin's action hooks where a nonce check might be absent or where the nonce is validated but the capability check is overlooked. The plugin likely uses a centralized request handler that routes actions based on query parameters or POST fields. The absence of authorization allows a subscriber to send a crafted HTTP request that invokes privileged operations, resulting in integrity (I:H — high) and availability (A:L — low) impact. The integrity impact is high because an attacker can modify, delete, or manipulate question-and-answer content, corrupting the site's data. The availability impact is low, as the attacker could potentially delete batches of content, causing service degradation but not full system unavailability.

Exploitation Scenarios

The exploitation of CVE-2026-65554 follows a structured chain, leveraging a low-privilege account to manipulate core plugin content.

Reconnaissance Phase: An attacker begins by identifying WordPress sites running the AnsPress plugin version 4.4.4. This can be achieved through Shodan queries (http.title:"AnsPress") or by scanning websites for the plugin's distinctive URL patterns and content structures (e.g., /questions/, /ask/). The attacker can also use WPScan, a WordPress vulnerability scanner, to fingerprint the plugin version by reading its readme.txt file or checking version hashes of static assets. Additionally, they might visit the site and interact with the Q&A interface to confirm the plugin is active.

Access Acquisition: The attacker ensures they have a subscriber-level account on the target. If the WordPress site allows user registration (a common default), the attacker registers a new account, inheriting the subscriber role. Alternatively, they may compromise an existing low-privilege account via credential stuffing or phishing. No higher privilege is required.

Triggering the Vulnerability: The attacker logs into the WordPress dashboard with their subscriber account. They then navigate to the AnsPress content management interface, which may be accessible via a dashboard menu item. Using browser developer tools, they intercept the HTTP requests generated when a legitimate user (e.g., an admin) performs a privileged action such as deleting a question or accepting an answer. The attacker replicates this request, modifying it to target the desired content identifier. Because the plugin's handler lacks a capability check, it processes the request even though the user is a subscriber.

For instance, the attacker might:

1. Intercept a POST request to admin-ajax.php or a custom endpoint, capturing the nonce and action parameters.
2. Replace the target question ID with one they want to delete.
3. Replay the request, confirming a successful deletion via the HTTP response. . Alternatively, the attacker could directly craft a request using a tool like curl, supplying valid session cookies obtained after logging in, to perform batch deletion of questions or to manipulate answer statuses.

Payload/Execution: The malicious request includes the subscriber's session cookies (maintaining authentication) and the crafted parameters targeting content mutations. The server processes the request, and the plugin's handler executes the delete or status-change operation without checking if the subscriber has permission. The action fires against the database, altering rows in the WordPress posts table (where AnsPress stores questions and answers as custom post types).

Post-Exploitation Impact: Upon successful deletion of a high-profile question or a set of questions, the attacker has demonstrated unauthorized write access to the plugin's data store. They could continue deleting content to deface the Q&A section, remove important announcements, or manipulate the recommended answers for questions — corrupting the integrity of the knowledge base. This could lead to user distrust, a decline in site engagement, and reputational damage.

Impact Assessment

The vulnerability has a CVSS score of 7.1 (High), reflecting the network-based attack vector, low complexity, and the high integrity impact despite requiring low privileges.

• Confidentiality Impact (C:N): None — the attacker cannot read data they are not already entitled to see.
• Integrity Impact (I:H): High — the attacker can modify or delete Q&A content at will, including deleting questions, altering answers, and changing accepted answer statuses. This corrupts the authoritative knowledge base of the site.
• Availability Impact (A:L): Low — while individual content items can be removed, the plugin itself continues to function. However, a large-scale deletion campaign could effectively disrupt the site's Q&A feature, diminishing its usefulness to the community.

Affected Systems: Only WordPress sites running the AnsPress plugin version 4.4.4. This version is likely a recent release at the time of the CVE's publication, meaning newly updated sites and those using the plugin for the first time are at immediate risk.

Blast Radius: The subscriber is a native WordPress role, and many sites enable user registration for community engagement. Therefore, any site with open registration and this plugin version is exposed. The attacker's reach is confined to the WordPress application (scope unchanged), but given that AnsPress manages user-generated content, targeted deletion campaigns could harm the site's community trust and SEO rankings. If the plugin shares the database with other applications (misconfigured hosting), the impact could theoretically extend, but this is outside the standard scope.

Detection Guidance

Sigma Rule

The following Sigma rule detects attempts to delete or modify AnsPress content by a user with insufficient privileges, flagging unusual activity in the WordPress admin AJAX interface.

title: AnsPress Broken Access Control - Unauthorized Content Deletion
id: 5a5f6e4d-9c3b-4f8a-9b2c-1d3e4f5a6b7c
status: experimental
description: Detects HTTP requests to WordPress admin-ajax.php with AnsPress actions from subscriber-level users.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65554
author: Security Analyst
date: 2026/11/17
tags:
    - attack.initial_access
    - attack.t1210
logsource:
    category: webserver
    product: apache
    definition: 'Requirements: Access logs must capture POST request bodies or use a WAF/IDS that inspects request payloads.'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'admin-ajax.php'
            - 'admin-post.php'
        cs-request-body|contains:
            - 'action=ap_'
    condition: selection
falsepositives:
    - Legitimate moderator actions could match if they use the same action prefix.
level: medium

YARA Rule

This YARA rule scans for HTTP payloads that contain patterns indicative of AnsPress exploitation attempts.

rule AnsPress_Broken_Access_Control {
    meta:
        author = "Security Analyst"
        date = "2026-11-17"
        description = "Detects HTTP requests attempting to exploit CVE-2026-65554 in AnsPress plugin"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65554"
        severity = "high"
    strings:
        $a1 = "ap_ajax" ascii nocase
        $a2 = "ap_change_status" ascii nocase
        $a3 = "action=ap_" ascii nocase
        $b1 = "delete_question" ascii nocase
        $b2 = "change_status" ascii nocase
        $c1 = "admin-ajax.php" ascii nocase
    condition:
        (2 of ($a*) and 1 of ($b*)) or ($c1 and 1 of ($b*))
}

Suricata IDS Rule

The following Suricata rule detects inbound HTTP POST requests targeting WordPress endpoints with AnsPress action parameters, flagging potential exploitation.

alert http any any -> any any (msg:"CVE-2026-65554 - AnsPress Broken Access Control Exploit Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; http.request_body; content:"action=ap_"; fast_pattern; http.request_body; pcre:"/action=ap_(delete_question|change_status)/i"; classtype:attempted-admin; sid:20261117; rev:1;)

Elastic Detection

The Elastic EQL query below identifies server-side logs that point to a subscriber performing privileged AnsPress actions.

sequence by source.ip with maxspan=5m
    [ network where network.direction == "ingress" and destination.port == 80 and
        http.request.method == "POST" and http.request.body.content contains "admin-ajax.php" ]
    [ any where process.executable == "*wp-admin*" and user.name != "admin" ]

Splunk SPL Query

This Splunk search identifies web server access logs containing POST requests to AnsPress endpoints with action parameters.

index=web sourcetype=access_combined
| spath input=form_data
| search method=POST AND uri_path="*/admin-ajax.php" AND form_data.action=ap_*
| stats count by src_ip, uri_path, form_data.action
| sort -count

Wazuh OSSEC Rule

The Wazuh XML rule monitors for a web server logs pattern indicating a POST to the AnsPress admin endpoint with restricted action parameters.

<group name="wordpress,">
  <rule id="100355" level="10">
    <decoded>Splunk</decoded>
    <match>admin-ajax.php.*action=ap_</match>
    <description>Possible AnsPress Broken Access Control exploitation (CVE-2026-65554)</description>
    <group>attack.t1210,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No evidence of a patch from any tracked source. The vendor (Patchstack) has disclosed the CVE but has not released a patched version of the AnsPress plugin. The "Affected Versions" list is empty, and "Vendor Fix" is N/A.

Immediate Mitigations (until a patch is available):

1. Disable user registration: If the site does not need public registration, disable the "Anyone can register" option in WordPress Settings to deny potential attackers the ability to create subscriber accounts.
2. Lock down subscriber privileges: Review the roles and capabilities on your WordPress site. Remove the 'read' capability from subscribers if they are not needed for the Q&A feature to function, or restrict their ability to interact with the plugin entirely.
3. Restrict access to admin-ajax.php: Use a Web Application Firewall (WAF) or server-level rules to block or challenge requests to admin-ajax.php that carry an action=ap_ parameter unless the request originates from an IP address known to be an administrator.
4. Monitor and audit: Enable logging of all admin-ajax.php requests with action parameters. Regularly review logs for unauthorized deletion or modification patterns. Set up automated alerts for a high frequency of content-deletion actions from a single low-privileged user.

Patch/Upgrade Steps:

1. Check for updates: Subscribe to the Patchstack advisory or the plugin's page on WordPress.org for when a patched version (likely 4.4.5 or later) is released. The NVD description "4.4.4 versions" implies a fix is expected but not yet published.
2. Apply the patch: Once available, update the AnsPress plugin from the WordPress dashboard. Always test the update in a staging environment first.
3. Fallback: If a patch is not forthcoming, consider disabling or removing the plugin if its functionality is not business-critical. Alternatively, the site administrator can harden the plugin by writing a custom mu-plugin (Must-Use) file that adds a capability check on the vulnerable hooks, but this is outside the scope of standard guidance.

Long-Term Hardening:

1. Adopt a principle of least privilege: Ensure that WordPress roles are configured so that only explicitly authorized users (e.g., Editors and Admins) have capabilities that map to AnsPress moderation actions.
2. Security plugin integration: Use a WordPress security plugin (e.g., Wordfence, Sucuri) that adds virtual patching or WAF rules specific to broken access control advisories. These plugins track CVE disclosures and can block exploitation attempts before a vendor patch exists.
3. Stay current: Maintain a vulnerability management program for WordPress core, themes, and plugins. Subscribe to CVE feeds and security newsletters focused on WordPress ecosystems to be alerted to emerging threats quickly.

References

1. NVD Entry: CVE-2026-65554 — Official CVE record with CVSS vector and description.
2. Patchstack Advisory: Patchstack Database — AnsPress 4.4.4 Subscriber Broken Access Control — The original advisory (CVE-2026-65554) documenting the vulnerability discovery.
3. WordPress Plugin Repository: AnsPress — Question and answer — Official plugin page, used to track releases and secure versions.
4. MITRE ATT&CK: T1210 — Exploitation of Remote Services — Technique mapping for this vulnerability's exploitation.

Exploitation in the Wild: No evidence of active exploitation in the wild has been reported to CISA KEV or other public sources as of the advisory date. However, due to the plugin's popularity and the simplicity of the attack, immediate mitigation is strongly recommended. Continuous monitoring for exploitation attempts is advised.