Cyber Resilience

CVE-2026-27361

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0005 15.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27361 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-27361 is a missing authorization vulnerability, mapped to CWE-862 (Missing Authorization), in the WebCodingPlace Responsive Posts Carousel Pro WordPress plugin (responsive-posts-carousel-pro). The flaw enables exploiting incorrectly configured access control security levels and affects all versions of the plugin from n/a through 15.1 inclusive. Published on 2026-03-05, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high severity due to its network accessibility and confidentiality impact.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), without changing the scope (S:U). Exploitation yields high confidentiality impact (C:H), allowing unauthorized access to sensitive data, while integrity (I:N) and availability (A:N) remain unaffected.

Patchstack advisories document this broken access control issue specifically in Responsive Posts Carousel Pro version 15.1, with details available at https://patchstack.com/database/Wordpress/Plugin/responsive-posts-carousel-pro/vulnerability/wordpress-responsive-posts-carousel-pro-plugin-15-1-broken-access-control-vulnerability?_s_id=cve. Security practitioners should consult this reference for recommended mitigations, such as applying available patches or restricting access to affected endpoints.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote unauthenticated exploitation of an internet-facing application for sensitive data access, matching T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-45209Shared CWE-862
CVE-2026-25026Shared CWE-862
CVE-2026-42083Shared CWE-862
CVE-2026-0656Shared CWE-862
CVE-2026-24532Shared CWE-862
CVE-2025-13603Shared CWE-862
CVE-2025-69063Shared CWE-862
CVE-2026-3045Shared CWE-862
CVE-2025-67956Shared CWE-862
CVE-2025-41765Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for logical access to information and system resources, directly addressing the missing authorization checks that allow unauthenticated attackers to access sensitive data.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of identified flaws, such as patching the specific missing authorization vulnerability in the Responsive Posts Carousel Pro plugin.

AC-6 Least Privilege partial match
prevent

Limits system access to the least privileges necessary, mitigating unauthorized data access even if authorization enforcement is incomplete.

References