CVE-2026-1984 Overview
CVE-2026-1984 affects the Ibtana – Ecommerce Product Addons plugin for WordPress in all versions up to and including 0.4.7.7. The plugin exposes the iepa_use_gt_editor AJAX action without a capability check, allowing authenticated users with Subscriber-level access or higher to modify or delete arbitrary post meta entries via the iepa_builder meta key. The flaw is classified as Missing Authorization [CWE-862].
Critical Impact
Any authenticated WordPress user, including low-privileged Subscribers, can tamper with or delete post meta entries on affected sites, potentially breaking content, page builder data, or WooCommerce product configurations.
Affected Products
- Ibtana – Ecommerce Product Addons plugin for WordPress
- All versions up to and including 0.4.7.7
- Sites where at least Subscriber-level registration is available
Discovery Timeline
- 2026-09-19 - CVE-2026-1984 published to the National Vulnerability Database (NVD)
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-1984
Vulnerability Analysis
The plugin registers the iepa_use_gt_editor AJAX endpoint to update post meta values used by its editor integration. According to the WordPress Plugin Code Review, the handler executes post meta write operations without verifying that the caller has permission to edit the target post.
Because WordPress AJAX endpoints registered under wp_ajax_ are reachable by any authenticated user, an attacker only needs a Subscriber account. The handler accepts a caller-supplied post identifier and writes to the iepa_builder meta key, enabling either overwrite or deletion of existing values on arbitrary posts.
The issue impacts data integrity rather than confidentiality or availability of the server itself. Corrupting the iepa_builder meta can break page-builder layouts, product configurations, or other functionality that reads from that key.
Root Cause
The root cause is a missing authorization check [CWE-862]. The AJAX callback does not invoke current_user_can() against the target post and does not validate that the requester owns or can edit it. A nonce check alone, if present, does not enforce capability boundaries because Subscribers can obtain valid nonces from authenticated pages.
Attack Vector
Exploitation requires network access to the WordPress admin-ajax.php endpoint and an authenticated session at Subscriber level or higher. The attacker submits a crafted POST request to admin-ajax.php with action=iepa_use_gt_editor, a target post ID, and payload data destined for the iepa_builder meta key. The server processes the request and modifies or deletes the specified post meta without validating the caller's capability against the post.
See the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset Information for the vendor fix.
Detection Methods for CVE-2026-1984
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing action=iepa_use_gt_editor originating from low-privileged user sessions.
- Unexpected modifications or deletions of the iepa_builder post meta key across posts or products.
- Sudden appearance of broken layouts or missing product-addon configurations on WooCommerce pages.
Detection Strategies
- Audit web server access logs for requests to admin-ajax.php with the iepa_use_gt_editor action, correlating source IP and authenticated user ID.
- Compare current iepa_builder meta values against known-good backups to identify unauthorized changes.
- Review WordPress user registration logs for anomalous Subscriber account creation preceding AJAX activity.
Monitoring Recommendations
- Enable database write auditing on the wp_postmeta table for changes targeting the iepa_builder key.
- Alert on authenticated AJAX calls to iepa_use_gt_editor from users whose roles do not include edit_posts capability.
- Track post meta deletion volume as a baseline metric and alert on deviations.
How to Mitigate CVE-2026-1984
Immediate Actions Required
- Update the Ibtana – Ecommerce Product Addons plugin to a version later than 0.4.7.7 as soon as the vendor patch is available.
- Restrict or disable open user registration on affected WordPress sites until the plugin is patched.
- Audit existing Subscriber accounts and revoke any that appear unused or suspicious.
Patch Information
The vendor addressed the issue in a commit tracked in the WordPress Plugin Changeset Information. Administrators should upgrade to the fixed release published on the WordPress plugin repository and verify via the plugin's version field in wp-admin.
Workarounds
- Temporarily deactivate the Ibtana – Ecommerce Product Addons plugin if an immediate update is not possible.
- Block requests to admin-ajax.php where action=iepa_use_gt_editor at a web application firewall (WAF) until the patch is applied.
- Set default_role in WordPress settings to a value below Subscriber for sites that do not require user accounts.
# Example WAF rule fragment to block the vulnerable action
# ModSecurity-style rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1002026,\
msg:'Block CVE-2026-1984 iepa_use_gt_editor'"
SecRule ARGS:action "@streq iepa_use_gt_editor"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.