CVE-2026-62134: Starter Templates IDOR Vulnerability

CVE-2026-62134 Overview

CVE-2026-62134 is an Insecure Direct Object Reference (IDOR) vulnerability in the WordPress Starter Templates plugin (also known as astra-sites) in versions up to and including 4.7.5. The flaw allows authenticated users with Contributor-level privileges to reference and manipulate objects belonging to other users or scopes without proper authorization checks. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
A low-privileged Contributor account can bypass authorization checks in Starter Templates <= 4.7.5, resulting in unauthorized modification of resources managed by the plugin.

Affected Products

WordPress Starter Templates plugin (astra-sites) versions <= 4.7.5
WordPress sites where Contributor-level accounts can access plugin endpoints
Environments relying on the plugin's default authorization model

Discovery Timeline

2026-09-11 - CVE-2026-62134 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-62134

Vulnerability Analysis

The Starter Templates plugin exposes functionality that accepts identifiers referencing internal objects such as posts, templates, or configuration entries. In affected versions, the plugin trusts client-supplied identifiers without verifying that the requesting user owns or is authorized to act on the referenced object. As a result, a Contributor authenticated to the WordPress instance can substitute another user's object identifier and have the plugin operate on it.

The vulnerability requires authentication and network access to the WordPress site. Exploitation does not require user interaction and does not affect confidentiality or availability, but it enables limited integrity impact by altering data the attacker should not be able to modify. Refer to the Patchstack Vulnerability Report for advisory details.

Root Cause

The root cause is missing authorization enforcement on object references handled by the plugin. The affected code paths validate that the caller is authenticated but do not verify ownership or capability on the target object identifier. This aligns with [CWE-639], where authorization decisions rely on user-controlled keys.

Attack Vector

An attacker first obtains or is granted a Contributor account on the target WordPress site. The attacker then issues authenticated HTTP requests to the plugin's endpoints, supplying identifiers for objects owned by other users. Because the plugin does not perform per-object authorization, the request succeeds and modifies the referenced resource.

No verified public exploit code is available for this issue. Consult the Patchstack Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-62134

Indicators of Compromise

Authenticated requests from Contributor accounts to Starter Templates (astra-sites) endpoints referencing object IDs the account does not own.
Unexpected modifications to posts, templates, or plugin configuration entries attributed to Contributor users.
Anomalous spikes in AJAX or REST calls to astra-sites handlers outside normal editorial workflows.

Detection Strategies

Review WordPress access logs for requests to astra-sites endpoints where the authenticated user role is Contributor.
Correlate object identifiers in request parameters against the ownership metadata recorded in the WordPress database.
Alert on any plugin-driven content change performed by users below Editor role.

Monitoring Recommendations

Enable WordPress audit logging that captures user ID, request path, and referenced object identifiers.
Forward web server and application logs to a centralized analytics platform for retention and correlation.
Track the installed version of the Starter Templates plugin across all managed WordPress sites and alert on versions <= 4.7.5.

How to Mitigate CVE-2026-62134

Immediate Actions Required

Upgrade the Starter Templates plugin to a version later than 4.7.5 as soon as an update is available from the vendor.
Audit existing Contributor accounts and remove or suspend accounts that are unused or unverified.
Review recent content and plugin configuration changes for unauthorized modifications performed by Contributor users.

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed version and vendor guidance. Apply the vendor-supplied patch through the WordPress plugin update mechanism.

Workarounds

Restrict Contributor role assignment to trusted users only until the plugin is updated.
Deploy a web application firewall rule that blocks unauthenticated or Contributor-level requests to astra-sites endpoints handling object identifiers.
Temporarily deactivate the Starter Templates plugin on sites where Contributor accounts are widely provisioned and the plugin is not in active use.

bash

# Example: list installed plugin version and disable via WP-CLI
wp plugin get astra-sites --field=version
wp plugin deactivate astra-sites