CVE-2026-42674 HIGH

CVE-2026-42674: WordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability

Vendor Aam Plugin
Product Advanced Access Manager
Weakness CWE-290
Published June 1, 2026
Last update June 1, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding. This issue affects Advanced Access Manager: from n/a through 7.1.0.

Explanation of Vulnerability in Simple Terms

02Summary

Advanced Access Manager versions up to 7.1.0 contain an authentication bypass vulnerability. An attacker can modify access control settings without proper verification, allowing unauthorized changes to site permissions and user roles. This affects the integrity of access control across the site. Update to a version newer than 7.1.0 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Modify access control settings and user permissions without authentication.

Potential impact on your site

04Site Impact

Attackers can alter user roles, permissions, and access rules, potentially granting themselves admin access.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 1, 2026 CVE published
June 1, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-42662 WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability CVE-2024-25906 WordPress Comments Like Dislike plugin <= 1.2.2 - IP Restriction Bypass Vulnerability vulnerability CVE-2024-32786 WordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerability CVE-2023-41133 WordPress Secure Admin IP plugin <= 2.0 - IP Spoofing vulnerability CVE-2026-24372 WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability