CVE-2026-54837 - WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

HIGH

WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

Published Jun 26, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.39%

Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
-	affected	<=1.8.1

Vendor solution

Update the WordPress Intranet & Private Site – All-In-One Intranet Plugin to the latest available version (at least 1.9.0).

Weaknesses (1)

CWE-862

Missing Authorization

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39680		Advisory
https://patchstack.com/database/wordpress/plugin/all-in-one-intranet/vulnerability/wordpress-intranet-private-site-all-in-one-intranet-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve		vdb-entry