CVE-2026-15293: WP Business Intelligence Auth Bypass Flaw

CVE-2026-15293 Overview

CVE-2026-15293 is an authorization bypass vulnerability in the WP Business Intelligence Lite plugin for WordPress. The flaw affects all versions up to and including 3.2.0. The plugin fails to verify whether a user is authorized to perform actions against stored SQL queries. Authenticated attackers with Subscriber-level access or higher can modify stored SQL queries. When an administrator later views the tampered query, the injected SQL executes with administrative context, enabling privilege escalation. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
A low-privileged Subscriber account can escalate to administrator by planting malicious SQL that executes when any administrator views the affected query.

Affected Products

WP Business Intelligence Lite plugin for WordPress — all versions ≤ 3.2.0
WordPress sites permitting Subscriber-level or higher registration with the plugin active
Multi-author WordPress deployments using this plugin for reporting

Discovery Timeline

2026-07-10 - CVE-2026-15293 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15293

Vulnerability Analysis

The WP Business Intelligence Lite plugin exposes an action handler for creating and modifying stored SQL queries used in the plugin's reporting interface. The handler does not enforce a capability check to confirm the requesting user has administrative rights over the query object. Any authenticated user, including Subscribers, can invoke the endpoint and overwrite the SQL body of an existing report.

The stored SQL is not executed at the moment of modification. Instead, execution occurs when an administrator opens the report through the plugin's admin menu defined in Admin/Menu/Query.php. At that point the query runs under the administrator's database context. This design turns a missing authorization check into a reliable privilege escalation primitive because arbitrary SQL can update the wp_users and wp_usermeta tables to grant administrator role to the attacker's account.

User interaction from an administrator is required for exploitation, which is reflected in the CVSS UI:R metric. However, on active sites administrators routinely open saved reports, making the interaction condition low-friction for attackers.

Root Cause

The root cause is the absence of a current_user_can() capability check on the query save handler registered in Loader.php. The plugin registers an AJAX or admin-post action available to any authenticated session and dispatches the write operation without verifying ownership of, or administrative rights to, the target query record. This is a textbook [CWE-862] Missing Authorization defect.

Attack Vector

Exploitation requires network access to the WordPress site and any authenticated account at Subscriber level or higher. The attacker sends a crafted request to the plugin's query modification endpoint, referencing an existing query ID and supplying arbitrary SQL. The malicious payload is stored in the database. When an administrator subsequently views the associated report page, the tampered SQL executes server-side. The attacker then logs in with elevated privileges or uses the newly created administrative account for further actions.

The relevant source locations are documented in the WordPress Plugin Code Review — Query.php and Loader.php references.

Detection Methods for CVE-2026-15293

Indicators of Compromise

Unexpected modifications to rows in the plugin's saved-queries table, particularly SQL strings containing INSERT INTO wp_users, UPDATE wp_usermeta, or references to wp_capabilities
New WordPress accounts assigned the administrator role that were not provisioned by known administrators
HTTP POST requests to admin-ajax.php or admin-post.php from Subscriber-level session cookies referencing the plugin's query-save action
Web server access logs showing repeated requests to plugin endpoints from low-privileged user sessions

Detection Strategies

Audit the WordPress database for saved queries whose contents deviate from expected SELECT-only patterns
Correlate WordPress user_registered events for Subscriber accounts with subsequent role changes to administrator
Alert on WordPress activity where a non-admin user account initiates writes to plugin-owned tables
Review the Wordfence Vulnerability Report for signature updates covering this CVE

Monitoring Recommendations

Forward WordPress and PHP-FPM logs to a centralized logging platform and alert on role escalation events
Enable WordPress audit logging plugins to record all capability changes and query modifications with attribution
Monitor outbound network traffic from the web host for anomalies that may follow a successful privilege escalation

How to Mitigate CVE-2026-15293

Immediate Actions Required

Deactivate and remove the WP Business Intelligence Lite plugin until a patched version is confirmed available
Review all WordPress user accounts and revoke any unexpected administrator role assignments
Rotate credentials for all administrator accounts and enforce multi-factor authentication
Inspect the plugin's stored queries and remove any that contain non-SELECT SQL statements

Patch Information

At the time of the NVD publication on 2026-07-10, no fixed version beyond 3.2.0 is referenced in the advisory. Site operators should monitor the Wordfence Vulnerability Report and the WordPress.org plugin page for a release that introduces current_user_can() checks on the affected handlers.

Workarounds

Restrict user registration on the WordPress site or disable Subscriber-level self-registration where not required
Deploy a web application firewall rule that blocks POST requests to the plugin's query-save endpoint from non-administrator sessions
Apply database-level restrictions so the WordPress database user cannot perform UPDATE on wp_users or wp_usermeta from unexpected contexts, where feasible

bash

# Configuration example: disable open registration and remove the plugin
wp option update users_can_register 0
wp plugin deactivate wp-business-intelligence-lite
wp plugin delete wp-business-intelligence-lite