CVE-2026-1984

Name of the Vulnerable Software and Affected Versions Ibtana – Ecommerce Product Addons versions prior to 0.4.7.8

Description Authenticated users with Subscriber-level access and above can perform unauthorized post meta modification. This is caused by a missing capability check on the 'iepa use gt editor' AJAX action, allowing attackers to update or delete arbitrary post meta entries using the iepa builder meta key.

Recommendations Update Ibtana – Ecommerce Product Addons to version 0.4.7.8 or later.