CVE-2026-18364: zportals WordPress Plugin Auth Bypass Flaw

CVE-2026-18364 Overview

CVE-2026-18364 is a missing authorization vulnerability in the zportals WordPress plugin before version 6.4.2. The plugin fails to perform capability or nonce checks on several AJAX actions. Authenticated users with subscriber-level accounts can modify the plugin's stored integration settings. The flaw is classified under [CWE-862] (Missing Authorization) and stems from broken access control on privileged administrative endpoints exposed through WordPress AJAX handlers.

Critical Impact
Any authenticated subscriber can tamper with integration settings stored by the zportals plugin, altering site configuration without administrative approval.

Affected Products

zportals WordPress plugin versions prior to 6.4.2
WordPress installations exposing the vulnerable AJAX actions to subscriber accounts
Sites permitting open user registration that grants subscriber-level access

Discovery Timeline

2026-09-23 - CVE-2026-18364 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-18364

Vulnerability Analysis

The zportals plugin registers several AJAX actions through the WordPress wp_ajax_ hook system. These handlers execute privileged operations that modify stored integration settings. The plugin omits both capability checks (current_user_can()) and nonce verification (check_ajax_referer()) inside these handlers. Any authenticated user, including low-privilege subscribers, can call the endpoints and change plugin state.

The issue falls under broken access control. The AJAX layer authenticates the request through the WordPress session cookie but never authorizes the action against the user's role or verifies request origin through a nonce token. Attackers with a subscriber account can automate configuration tampering against integration settings that normally require administrator context.

Root Cause

The root cause is the absence of authorization logic on privileged AJAX handlers registered by the plugin. WordPress does not enforce role checks automatically on wp_ajax_{action} callbacks. Developers must invoke current_user_can() and check_ajax_referer() inside each handler. The zportals plugin skips both checks on the affected actions, exposing integration settings to any logged-in user.

Attack Vector

Exploitation requires an authenticated subscriber account on the target WordPress site. The attacker sends a crafted POST request to /wp-admin/admin-ajax.php specifying the vulnerable action parameter and the desired integration settings payload. The plugin processes the request and writes the attacker-supplied values to the WordPress options table. On sites allowing self-registration, an attacker can create the required account without prior access.

See the WPScan Vulnerability Report for additional technical details on the affected AJAX actions.

Detection Methods for CVE-2026-18364

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php originating from subscriber-role sessions
Modifications to zportals integration settings in the wp_options table without a corresponding administrator action
New subscriber accounts registered shortly before configuration changes

Detection Strategies

Inspect WordPress access logs for AJAX action names associated with the zportals plugin invoked by non-administrator users
Correlate wp_options modifications with the acting user ID recorded in application logs or audit plugins
Alert on bursts of admin-ajax.php traffic from newly registered accounts

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture user actions and option changes
Forward web server and WordPress logs to a centralized analytics platform for retention and query
Baseline the normal volume of subscriber AJAX activity and alert on deviations

How to Mitigate CVE-2026-18364

Immediate Actions Required

Update the zportals WordPress plugin to version 6.4.2 or later on all affected sites
Audit existing subscriber accounts and remove any created without a business justification
Review the plugin's integration settings and revert any unauthorized changes

Patch Information

The vendor addressed the vulnerability in zportals version 6.4.2 by adding capability and nonce checks to the affected AJAX handlers. Upgrade through the WordPress plugin dashboard or the WP-CLI wp plugin update zportals command. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the zportals plugin until the update to 6.4.2 or later is applied
Temporarily disable open user registration by unsetting the users_can_register option
Restrict access to /wp-admin/admin-ajax.php at the web application firewall for the affected action names

bash

# Update the plugin using WP-CLI
wp plugin update zportals --version=6.4.2

# Disable open registration as a temporary control
wp option update users_can_register 0