CVE-2026-27362: WP Bakery Autoresponder Auth Bypass Flaw

CVE-2026-27362 Overview

CVE-2026-27362 is a Missing Authorization vulnerability (CWE-862) in the WP Bakery Autoresponder Addon (vc-autoresponder-addon) WordPress plugin developed by kamleshyadav. This security flaw allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized access to protected functionality within the plugin.

The vulnerability stems from broken access control mechanisms that fail to properly verify user permissions before allowing access to sensitive plugin features. This type of vulnerability can be particularly dangerous in WordPress environments where plugins often handle sensitive data and administrative functions.

Critical Impact
Attackers can bypass authorization checks to access restricted functionality, potentially leading to unauthorized data access, configuration changes, or privilege escalation within WordPress installations using this plugin.

Affected Products

WP Bakery Autoresponder Addon versions up to and including 1.0.6
WordPress installations with vc-autoresponder-addon plugin installed
Sites using WP Bakery page builder with this addon integration

Discovery Timeline

2026-03-05 - CVE CVE-2026-27362 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27362

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw classified under CWE-862 (Missing Authorization). The WP Bakery Autoresponder Addon fails to implement proper authorization checks on one or more of its functionality endpoints. In WordPress plugin architecture, proper access control typically involves verifying user capabilities through functions like current_user_can() before executing privileged operations.

When authorization checks are missing, any authenticated user—or in some cases, unauthenticated visitors—may be able to invoke functionality that should be restricted to administrators or other privileged roles. This can lead to unauthorized modification of plugin settings, access to sensitive subscriber data, or manipulation of autoresponder configurations.

Root Cause

The root cause of this vulnerability is the absence of capability checks within the plugin's request handling logic. The plugin exposes functionality through WordPress hooks or AJAX handlers without verifying that the requesting user has appropriate permissions to perform the requested action. This represents a fundamental security oversight in the plugin's access control implementation.

Proper WordPress security practices require plugins to implement explicit authorization checks using WordPress capability system before processing any sensitive operations. The absence of these checks in versions through 1.0.6 allows any user to potentially access administrative functions.

Attack Vector

An attacker could exploit this vulnerability by identifying the unprotected endpoints or AJAX actions within the plugin and crafting direct requests to these endpoints. Since the plugin fails to verify user authorization, these requests would be processed regardless of the attacker's actual permission level.

The attack typically involves:

Identifying the vulnerable plugin endpoints through code analysis or network traffic inspection
Crafting HTTP requests directly to these endpoints, bypassing the normal WordPress interface
Executing privileged operations without proper authorization

For technical implementation details and verified exploitation patterns, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27362

Indicators of Compromise

Unexpected changes to autoresponder settings or configurations without corresponding administrator activity
Unusual plugin-related requests in WordPress access logs from non-administrative users
Database modifications to plugin options tables (wp_options) without authorized changes
Suspicious AJAX requests targeting vc-autoresponder-addon endpoints from low-privilege accounts

Detection Strategies

Review WordPress access logs for requests to plugin-specific endpoints from unauthorized IP addresses or user sessions
Monitor for changes to plugin configuration options in the WordPress database
Implement WordPress security plugins that track capability-based access violations
Audit user activity logs for plugin interactions by non-administrator accounts

Monitoring Recommendations

Enable comprehensive logging for all AJAX requests and plugin interactions within WordPress
Configure alerts for unauthorized access attempts to administrative plugin functions
Regularly audit the installed plugin version against known vulnerable versions
Deploy web application firewall (WAF) rules to detect and block exploit attempts targeting this vulnerability

How to Mitigate CVE-2026-27362

Immediate Actions Required

Audit current plugin version and confirm if vc-autoresponder-addon version 1.0.6 or earlier is installed
Consider temporarily deactivating the WP Bakery Autoresponder Addon until a patched version is available
Review WordPress user accounts and remove unnecessary privileges from non-administrative users
Implement additional access control layers through WordPress security plugins or WAF solutions

Patch Information

At the time of publication, the vulnerability affects WP Bakery Autoresponder Addon versions through 1.0.6. Website administrators should monitor the plugin repository and the Patchstack Vulnerability Report for updates regarding security patches from the developer.

Workarounds

Temporarily disable the vc-autoresponder-addon plugin if functionality is not critical
Implement server-level access restrictions to plugin directories and AJAX endpoints
Use a WordPress security plugin to add additional capability checks at the application layer
Restrict WordPress admin access to trusted IP addresses only

bash

# Configuration example - Restrict access to plugin AJAX endpoints via .htaccess
# Add to WordPress root .htaccess file

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*admin-ajax\.php.*$
RewriteCond %{QUERY_STRING} action=.*vc_autoresponder.*
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.100$
RewriteRule ^(.*)$ - [F,L]
</IfModule>