What the vulnerability does
01Description
Missing Authorization vulnerability in Pierre JEHAN Owl Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Owl Carousel: from n/a through 0.5.3.
CVE-2022-44578
MEDIUM
CVE-2022-44578: WordPress Owl Carousel plugin <= 0.5.3 - Broken Access Control vulnerability
CVSS base score
5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Explanation of Vulnerability in Simple Terms
02Summary
Owl Carousel versions up to 0.5.3 lack proper authorization checks, allowing an attacker to modify carousel content or settings without authentication. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 0.5.3 to prevent unauthorized changes to carousel functionality.
What an attacker can do
03Attacker Capabilities
Modify carousel content or settings without logging in.
Potential impact on your site
04Site Impact
Carousel content or configuration could be altered by unauthorized users.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication required.
Key dates
06Disclosure timeline
December 13, 2024
CVE published
April 28, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-12432 Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
CVE-2026-57669 WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability
CVE-2026-12349 Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions
CVE-2026-11912 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
CVE-2026-57335 WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability
