CVE-2026-93513: SiteSkite IDOR Vulnerability

CVE-2026-93513 Overview

CVE-2026-93513 is an Insecure Direct Object Reference (IDOR) vulnerability in the SiteSkite WordPress plugin, affecting versions up to and including 2.1.7. The flaw allows authenticated users with Contributor-level privileges to access or manipulate objects belonging to other users by referencing identifiers directly. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

The vulnerability requires network access and low-privilege authentication, with no user interaction. Impact is limited to integrity of data, with no direct confidentiality or availability effects reported.

Critical Impact
Authenticated Contributors can modify resources belonging to other users on affected WordPress sites, undermining the plugin's authorization boundary.

Affected Products

SiteSkite WordPress plugin, versions <= 2.1.7
WordPress installations that have the SiteSkite plugin activated
Sites permitting Contributor-level account registration or delegation

Discovery Timeline

2026-09-23 - CVE-2026-93513 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93513

Vulnerability Analysis

The SiteSkite plugin exposes functionality that references internal objects, such as post IDs or resource identifiers, using values supplied directly by the client. The plugin does not enforce a proper authorization check verifying that the requesting user owns or is permitted to act on the referenced object. As a result, a user authenticated at the Contributor role can supply another user's object identifier and perform actions against it.

The vulnerability aligns with CWE-639, in which access control depends on a key that the requester can modify. Because the attack occurs over the network with only low privileges and no user interaction, exploitation can be scripted against any WordPress site that accepts Contributor registrations or manages multiple content authors.

Root Cause

The root cause is missing or insufficient authorization logic around object access. The plugin trusts the object identifier submitted in the request without validating that the current session's user has ownership of, or explicit rights to, the target object. This is a design-level authorization flaw rather than an input validation or memory safety issue.

Attack Vector

An attacker authenticates to the target WordPress site using any Contributor account. The attacker then submits a request to a SiteSkite plugin endpoint, substituting the identifier of a resource owned by another user. Because the plugin authorizes based only on session validity and not on object ownership, the request succeeds and the target object is modified. Full technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-93513

Indicators of Compromise

Unexpected modifications to posts, drafts, or plugin-managed resources by Contributor accounts
HTTP POST or admin-ajax requests from Contributor sessions targeting SiteSkite endpoints with object IDs outside the user's own content
Newly registered Contributor accounts followed by requests referencing content owned by editors or administrators

Detection Strategies

Enable WordPress audit logging and correlate object modification events with the acting user's role and stated ownership
Review web server access logs for repeated requests to SiteSkite plugin endpoints containing enumerated numeric identifiers
Baseline normal Contributor behavior and flag actions that touch resources owned by other users

Monitoring Recommendations

Forward WordPress and web server logs into a centralized analytics platform for role-versus-object correlation
Alert on any Contributor account making authenticated requests that modify content attributed to another author
Monitor plugin update status and flag installations still running SiteSkite <= 2.1.7

How to Mitigate CVE-2026-93513

Immediate Actions Required

Update the SiteSkite plugin to a version later than 2.1.7 as soon as a fixed release is available from the vendor
Audit existing Contributor accounts and disable any that are unused or unverified
Temporarily restrict Contributor-level content operations if the plugin cannot be updated immediately

Patch Information

Refer to the Patchstack Vulnerability Report for vendor patch status and remediation guidance. Apply the vendor-supplied fix to all WordPress installations running SiteSkite <= 2.1.7.

Workarounds

Deactivate the SiteSkite plugin until a patched version is installed if the affected functionality is not essential
Disable open user registration or restrict new registrations to the Subscriber role only
Deploy a web application firewall rule to block Contributor-session requests to SiteSkite endpoints that reference object IDs outside the requester's own content

bash

# Configuration example: disable open registration and force Subscriber default
wp option update users_can_register 0
wp option update default_role subscriber

# Deactivate the vulnerable plugin until patched
wp plugin deactivate siteskite