CVE-2026-1984
Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.
| CWE | CWE-862 |
| Vendor | vowelweb |
| Product | ibtana – ecommerce product addons |
| Published | Sep 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for vowelweb ibtana – ecommerce product addons
Be the first to know when new medium vulnerabilities affecting vowelweb ibtana – ecommerce product addons are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
vowelweb / Ibtana – Ecommerce Product Addons
0 ≤ 0.4.7.7
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e20253-4002-467a-9dca-10bc2bfe4514?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ibtana-ecommerce-product-addons/trunk/inc/class-pro.php#L58 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ibtana-ecommerce-product-addons/tags/0.4.7.5/inc/class-pro.php#L58 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ibtana-ecommerce-product-addons/trunk/inc/class-pro.php#L25 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&old=3587239%40ibtana-ecommerce-product-addons&new=3587239%40ibtana-ecommerce-product-addons
Credits
Legion Hunter