Read the docs
TI-2026-69980 Aliases CVE-2026-62028GHSA-xpr7-4jqm-h3cm

Before After Image Comparison WordPress plugin missing authorization

Priority LOW 23CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Before After Image Comparison plugin by bPlugins, package before-after-image-compare, has a missing authorization flaw (CWE-862) that allows exploitation of incorrectly configured access control security levels. Versions from n/a through 1.1.21 are affected, and no fix is listed. CVSS 3.1 scores it 5.4 (MEDIUM), with a network attack vector, low privileges required, and partial confidentiality and integrity impact. CISA SSVC reports no exploitation, not automatable, and partial technical impact, and the flaw is not in KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bPluginsBefore After Image Comparison – Image comparison for WPup to 1.1.21—No fix listedCNA
  • Before After Image Comparison – Image comparison for WP VendorbPlugins Affected up to 1.1.21 Fixed in — No fix listed CNA

Remediation

No fixed version is listed. Remove the plugin or restrict access to its settings until bPlugins publishes a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-62028
  2. 2026-10-09 Alias added: GHSA-xpr7-4jqm-h3cm
  3. 2026-10-11 CISA SSVC decision points changed
  4. 2026-10-11 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2024-05133 HTML5 Video Player < 2.5.27 - Unauthenticated SQLi CVSS 3.1MEDIUM 6.5
  • TI-2024-00982 SQL injection in html5-video-player CVSS 3.1CRITICAL 9.8
  • TI-2023-00164 Html5 Audio Player < 2.1.12 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2025-11361 Missing authorization in bPlugins Document Embedder – Embed PDFs, Word, Excel, and Other… CVSS 3.1HIGH 8.6
  • TI-2025-07373 B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function CVSS 3.1CRITICAL 9.8
  • TI-2026-40456 WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability CVSS 3.1HIGH 8.3
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences