Colibri Page Builder <= 1.0.260 - Missing Authorization
Priority LOW 20CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260. This makes it possible for authenticated attackers, with subscriber access or higher, to update the license key.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| extendthemes | Colibri Page Builder | up to 1.0.260 | — | No fix listed | CNA |
- Colibri Page Builder Vendorextendthemes Affected up to 1.0.260 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:extendthemes:colibri_page_builder:*:*:*:*:*:wordpress:*:* | before 1.0.263 | Vulnerable | extendthemes |
- cpe:2.3:a:extendthemes:colibri_page_builder:*:*:*:*:*:wordpress:*:* Versions before 1.0.263 Vulnerable ·extendthemes
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1870
- 2026-10-03 Alias added: GHSA-6pw4-99gp-9gj7
References
More extendthemes Colibri Page Builder vulnerabilities
- TI-2023-02052 Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id CVSS 3.1HIGH 7.2
- TI-2025-23283 WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2024-03122 Cross-site scripting in extendthemes Colibri Page Builder CVSS 3.1MEDIUM 6.4
- TI-2023-27738 WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
- TI-2023-06389 Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
- TI-2024-04679 Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
Sources
- CVE-2024-1870 · CVE Program
- CVE-2024-1870 · NVD
- FIRST EPSS
- GHSA-6pw4-99gp-9gj7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences