CVE-2026-9184: 24liveblog WordPress Auth Bypass Flaw

CVE-2026-9184 Overview

CVE-2026-9184 affects the 24liveblog live blog tool plugin for WordPress in versions up to and including 2.2. The vulnerability resides in the update_lb24_token() AJAX handler, which only verifies the lb24 nonce and omits a capability check on the calling user. Because the lb24 nonce is localized to any user with block editor access through lb24_block_enqueue_scripts(), authenticated attackers holding author-level privileges or higher can invoke the handler against arbitrary accounts. The flaw permits overwriting lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname user meta values for any user, including administrators, along with the corresponding site-wide options. This results in hijacking of the plugin's integration with the 24liveblog service. The issue is categorized under [CWE-862] Missing Authorization.

Critical Impact
An author-level WordPress user can overwrite the 24liveblog token, refresh token, UID, and username meta of any account, hijacking the site's integration with the upstream 24liveblog service.

Affected Products

24liveblog - live blog tool plugin for WordPress, versions up to and including 2.2
WordPress sites that grant author-level or higher access to untrusted users
WordPress instances exposing the plugin's update_lb24_token AJAX action

Discovery Timeline

2026-06-24 - CVE-2026-9184 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9184

Vulnerability Analysis

The 24liveblog plugin registers an authenticated AJAX action that maps to the update_lb24_token() function. The handler reads a user_id parameter from the request and writes 24liveblog-related user meta values to that user. The handler validates only the lb24 nonce and does not call current_user_can() or verify that the supplied user_id matches the requesting user. Because lb24_block_enqueue_scripts() localizes the nonce to any user with block editor access, the nonce is trivially obtainable by author-level accounts and above. The handler also persists the supplied values to site-wide options, propagating the attacker-controlled tokens beyond a single user record.

Root Cause

The root cause is a missing capability check on a privileged state-changing AJAX endpoint. Nonce verification confirms request origin but does not constitute authorization. By treating the lb24 nonce as sufficient and trusting an attacker-supplied user_id, the plugin allows lower-privileged callers to mutate meta belonging to higher-privileged users.

Attack Vector

An attacker authenticates to the target WordPress site as an author or higher. The attacker loads the block editor to retrieve the localized lb24 nonce. The attacker then submits a POST request to admin-ajax.php with action=update_lb24_token, the nonce, a user_id belonging to an administrator, and the desired lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname values. The handler writes the attacker's tokens to the administrator's user meta and the site-wide options, redirecting the plugin's integration with the 24liveblog service to attacker-controlled credentials. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet for the affected handler source.

Detection Methods for CVE-2026-9184

Indicators of Compromise

Unexpected POST requests to wp-admin/admin-ajax.php with action=update_lb24_token originating from author, editor, or contributor accounts.
Changes to lb24_token, lb24_uid, lb24_refresh_token, or lb24_uname user meta on administrator accounts without a corresponding administrator-initiated session.
Updates to the site-wide lb24_* options outside of normal plugin configuration workflows.

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying action=update_lb24_token and correlate the authenticated user identifier with the submitted user_id parameter; mismatches indicate exploitation attempts.
Audit the wp_usermeta table for lb24_* keys assigned to administrator users and compare timestamps against legitimate plugin configuration events.
Enable WordPress audit logging to capture option and user meta changes tied to the 24liveblog plugin.

Monitoring Recommendations

Alert on AJAX activity to plugin-specific actions invoked by non-administrative roles.
Monitor for outbound API traffic from the WordPress host to 24liveblog endpoints using unfamiliar token identifiers.
Track new or modified WordPress accounts at author level or above, since exploitation requires that minimum privilege.

How to Mitigate CVE-2026-9184

Immediate Actions Required

Update the 24liveblog plugin to a version later than 2.2 once the vendor publishes a fix; until then, deactivate the plugin on production sites.
Review administrator accounts for unexpected lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname values and reset them.
Rotate 24liveblog service credentials and revoke any refresh tokens that may have been overwritten.
Restrict author-level and higher access to trusted users and remove dormant elevated accounts.

Patch Information

At the time of publication, the NVD entry for CVE-2026-9184 lists vulnerable versions up to and including 2.2. Consult the Wordfence Vulnerability Report and the plugin's WordPress.org page for the fixed release. The corrective change must add a current_user_can() capability check and validate that the supplied user_id matches get_current_user_id() inside update_lb24_token().

Workarounds

Deactivate the 24liveblog plugin until a patched version is installed.
Deploy a web application firewall rule that blocks admin-ajax.php requests with action=update_lb24_token from sessions whose role is below administrator.
Use a custom mu-plugin to short-circuit the wp_ajax_update_lb24_token action for non-administrators by calling wp_die() when current_user_can('manage_options') returns false.

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate 24liveblog
wp option get lb24_token
wp option delete lb24_token lb24_uid lb24_refresh_token lb24_uname