Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-19840— Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

Quick assessment

Affected
Unknown Notiqoo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Notiqoo WordPress 插件在 1.4.14 版本之前的版本中，部分 AJAX 操作缺少权限检查，且根据用户输入构建要写入的选项名称。这使得角色低至 contributor（贡献者）的用户可以修改任意 WordPress 选项，从而能够停用 1.4.14 之前的 Notiqoo 插件，甚至将所有管理员锁定在站点之外。

AI Predicted 6.5 Difficulty: Easy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19840

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions
Source: CVE Program / CVE List V5
Vulnerability Description
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Notiqoo 0 ~ 1.4.14 -

II. Public POCs for CVE-2026-19840

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19840

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-19840 (1)

Same Patch Batch · Unknown · 2026-09-10 · 8 CVEs total

CVE-2026-82925 Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Un
CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Em
CVE-2026-77771 miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
CVE-2026-78361 zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Optio
CVE-2026-19436 Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation v
CVE-2026-19439 Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Cus

IV. Related Vulnerabilities

Same vendor: Unknown

V. Comments for CVE-2026-19840

No comments yet

Leave a comment