CVE-2026-5347 Overview
CVE-2026-5347 is a Missing Authorization vulnerability [CWE-862] affecting the HM Books Gallery plugin for WordPress in versions up to and including 4.8.0. The flaw resides in the admin_init hook handler at lines 205-209 of wp-books-gallery.php. The code updates the wbg_cpt_slug option based on a permalink_structure POST parameter without verifying capabilities or nonces. Unauthenticated attackers can change the custom post type slug used by the books gallery. This alters URLs for all book entries, breaks existing links, and damages SEO rankings.
Critical Impact
Unauthenticated remote attackers can modify the custom post type slug for the books gallery, breaking all book entry URLs and harming site SEO.
Affected Products
- HM Books Gallery plugin for WordPress
- Versions up to and including 4.8.0
- Fixed in version 4.8.1
Discovery Timeline
- 2026-04-24 - CVE-2026-5347 published to NVD
- 2026-04-24 - Last updated in NVD database
Technical Details for CVE-2026-5347
Vulnerability Analysis
The HM Books Gallery plugin registers an admin_init callback that processes permalink settings updates. WordPress fires admin_init on every request to the admin area, but the hook itself does not enforce authentication for the request handler logic. The plugin code at lines 205-209 of wp-books-gallery.php checks only whether the permalink_structure parameter exists in the POST body before calling update_option against wbg_cpt_slug. No current_user_can() capability check is performed, and no wp_verify_nonce() call validates request authenticity. As a result, any unauthenticated visitor who sends a crafted POST request to an admin endpoint can overwrite the slug controlling the books gallery custom post type.
Root Cause
The root cause is missing authorization enforcement in an admin_init handler. The plugin trusts the presence of a POST parameter as sufficient justification to modify a persistent option. WordPress requires plugin authors to implement their own capability checks and CSRF protection in admin handlers; this plugin omits both controls.
Attack Vector
An unauthenticated attacker sends a POST request containing a permalink_structure field and a new slug value to the WordPress admin endpoint where the plugin registers its handler. The admin_init hook fires, the plugin reads the POST data, and wbg_cpt_slug is updated to the attacker-supplied value. All book entry URLs then resolve under the new slug, breaking inbound links, bookmarks, and search engine indexing for the affected site. The vulnerability does not expose data confidentiality but causes integrity impact to site configuration and content URLs.
Detection Methods for CVE-2026-5347
Indicators of Compromise
- Unexpected changes to the wbg_cpt_slug option value in the wp_options table.
- Sudden 404 errors on previously valid book gallery URLs across the site.
- POST requests to WordPress admin endpoints containing a permalink_structure parameter from unauthenticated sessions.
- Search engine crawler errors or sudden SEO ranking drops for book content pages.
Detection Strategies
- Monitor the wp_options table for unauthorized writes to wbg_cpt_slug.
- Inspect web server access logs for POST requests to /wp-admin/ endpoints lacking a valid authenticated session cookie.
- Compare current custom post type slug values against a known-good configuration baseline.
- Deploy a web application firewall rule that blocks unauthenticated POST requests carrying permalink_structure to admin paths.
Monitoring Recommendations
- Enable WordPress audit logging to capture option updates with the requesting user and IP address.
- Alert on any modification to the wbg_cpt_slug option outside scheduled maintenance windows.
- Track HTTP 404 rate anomalies on URLs matching the books gallery path pattern.
How to Mitigate CVE-2026-5347
Immediate Actions Required
- Update the HM Books Gallery plugin to version 4.8.1 or later on all WordPress installations.
- Audit the current value of wbg_cpt_slug in the database and restore it if tampered with.
- Review web server logs for prior exploitation attempts against admin endpoints.
- Verify books gallery URLs render correctly and submit updated sitemaps to search engines if slugs changed.
Patch Information
The vendor addressed the issue in HM Books Gallery version 4.8.1. The fix adds capability and nonce verification to the permalink settings update handler. Refer to the WordPress Plugin Code Reference for 4.8.1 and the Wordfence Vulnerability Report for additional details.
Workarounds
- Deactivate the HM Books Gallery plugin until the patched version can be installed.
- Apply a WAF rule blocking unauthenticated POST requests that include a permalink_structure parameter targeting /wp-admin/ paths.
- Restrict access to /wp-admin/ by source IP address using web server or reverse proxy controls.
# Example WAF rule (ModSecurity) blocking unauthenticated permalink updates
SecRule REQUEST_URI "@beginsWith /wp-admin/" \
"chain,phase:2,deny,status:403,id:1026534701,msg:'Block CVE-2026-5347 unauth permalink update'"
SecRule ARGS:permalink_structure "@rx .+" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
