CVE-2026-22472

Medium

Published: 22 January 2026

Published

22 January 2026

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS Score 0.0019 8.2th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-22472 is a medium-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-22472 is a missing authorization vulnerability (CWE-862) in the Easy Form Builder WordPress plugin by hassantafreshi. It enables exploitation of incorrectly configured access control security levels and affects all versions of the plugin from n/a through 3.9.6. The vulnerability has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), indicating medium severity with low privileges required for exploitation.

A low-privileged authenticated user can exploit this vulnerability remotely over the network with low complexity and no user interaction. Exploitation allows limited integrity impact, such as unauthorized modifications due to bypassed access controls, without affecting confidentiality or availability.

The Patchstack advisory provides further details on this broken access control issue in the Easy Form Builder plugin: https://patchstack.com/database/Wordpress/Plugin/easy-form-builder/vulnerability/wordpress-easy-form-builder-plugin-3-9-4-broken-access-control-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3834

Vulnerability details

Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authorization (broken access control) in public-facing WordPress plugin directly enables remote exploitation of the web application by authenticated low-priv users.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0