CVE-2026-27362: WP Bakery Autoresponder Auth Bypass Flaw

CVE-2026-27362 Overview

CVE-2026-27362 is a Missing Authorization vulnerability (CWE-862) in the WP Bakery Autoresponder Addon (vc-autoresponder-addon) WordPress plugin developed by kamleshyadav. This security flaw allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized access to protected functionality within the plugin.

The vulnerability stems from broken access control mechanisms that fail to properly verify user permissions before allowing access to sensitive plugin features. This type of vulnerability can be particularly dangerous in WordPress environments where plugins often handle sensitive data and administrative functions.

Critical Impact

Attackers can bypass authorization checks to access restricted functionality, potentially leading to unauthorized data access, configuration changes, or privilege escalation within WordPress installations using this plugin.

Affected Products

• WP Bakery Autoresponder Addon versions up to and including 1.0.6
• WordPress installations with vc-autoresponder-addon plugin installed
• Sites using WP Bakery page builder with this addon integration

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-27362 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27362

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw classified under CWE-862 (Missing Authorization). The WP Bakery Autoresponder Addon fails to implement proper authorization checks on one or more of its functionality endpoints. In WordPress plugin architecture, proper access control typically involves verifying user capabilities through functions like current_user_can() before executing privileged operations.

When authorization checks are missing, any authenticated user—or in some cases, unauthenticated visitors—may be able to invoke functionality that should be restricted to administrators or other privileged roles. This can lead to unauthorized modification of plugin settings, access to sensitive subscriber data, or manipulation of autoresponder configurations.

Root Cause

The root cause of this vulnerability is the absence of capability checks within the plugin's request handling logic. The plugin exposes functionality through WordPress hooks or AJAX handlers without verifying that the requesting user has appropriate permissions to perform the requested action. This represents a fundamental security oversight in the plugin's access control implementation.

Proper WordPress security practices require plugins to implement explicit authorization checks using WordPress capability system before processing any sensitive operations. The absence of these checks in versions through 1.0.6 allows any user to potentially access administrative functions.

Attack Vector

An attacker could exploit this vulnerability by identifying the unprotected endpoints or AJAX actions within the plugin and crafting direct requests to these endpoints. Since the plugin fails to verify user authorization, these requests would be processed regardless of the attacker's actual permission level.

The attack typically involves:

1. Identifying the vulnerable plugin endpoints through code analysis or network traffic inspection
2. Crafting HTTP requests directly to these endpoints, bypassing the normal WordPress interface
3. Executing privileged operations without proper authorization

For technical implementation details and verified exploitation patterns, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27362

Indicators of Compromise

• Unexpected changes to autoresponder settings or configurations without corresponding administrator activity
• Unusual plugin-related requests in WordPress access logs from non-administrative users
• Database modifications to plugin options tables (wp_options) without authorized changes
• Suspicious AJAX requests targeting vc-autoresponder-addon endpoints from low-privilege accounts

Detection Strategies

• Review WordPress access logs for requests to plugin-specific endpoints from unauthorized IP addresses or user sessions
• Monitor for changes to plugin configuration options in the WordPress database
• Implement WordPress security plugins that track capability-based access violations
• Audit user activity logs for plugin interactions by non-administrator accounts

Monitoring Recommendations

• Enable comprehensive logging for all AJAX requests and plugin interactions within WordPress
• Configure alerts for unauthorized access attempts to administrative plugin functions
• Regularly audit the installed plugin version against known vulnerable versions
• Deploy web application firewall (WAF) rules to detect and block exploit attempts targeting this vulnerability

How to Mitigate CVE-2026-27362

Immediate Actions Required

• Audit current plugin version and confirm if vc-autoresponder-addon version 1.0.6 or earlier is installed
• Consider temporarily deactivating the WP Bakery Autoresponder Addon until a patched version is available
• Review WordPress user accounts and remove unnecessary privileges from non-administrative users
• Implement additional access control layers through WordPress security plugins or WAF solutions

Patch Information

At the time of publication, the vulnerability affects WP Bakery Autoresponder Addon versions through 1.0.6. Website administrators should monitor the plugin repository and the Patchstack Vulnerability Report for updates regarding security patches from the developer.

Workarounds

• Temporarily disable the vc-autoresponder-addon plugin if functionality is not critical
• Implement server-level access restrictions to plugin directories and AJAX endpoints
• Use a WordPress security plugin to add additional capability checks at the application layer
• Restrict WordPress admin access to trusted IP addresses only

# Configuration example - Restrict access to plugin AJAX endpoints via .htaccess
# Add to WordPress root .htaccess file

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*admin-ajax\.php.*$
RewriteCond %{QUERY_STRING} action=.*vc_autoresponder.*
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.100$
RewriteRule ^(.*)$ - [F,L]
</IfModule>