CVE-2026-9184

Name of the Vulnerable Software and Affected Versions 24liveblog versions prior to 2.3

Description The 24liveblog plugin for WordPress allows unauthorized data modification because the update lb24 token() AJAX function lacks a proper capability check. The handler verifies the 'lb24' nonce but fails to confirm the user's permissions or ensure the user id belongs to the current user. Consequently, authenticated attackers with author-level access or higher can overwrite the lb24 token, lb24 uid, lb24 refresh token, and lb24 uname user meta values for any user, including administrators, and modify site-wide options to hijack the integration with the 24liveblog service.

Recommendations Update the plugin to a version newer than 2.2. As a temporary workaround, restrict access to the update lb24 token() function for users with author-level permissions.