Security readout for executives and security teams
Plain-English summary
A WordPress Greenshift plugin flaw lets any logged-in user, even a Subscriber, access global plugin settings. Those settings may include stored AI API keys. The same weakness can allow changes to settings that create stored cross-site scripting through custom_css. Sites with public registration or many low-privilege users have higher business risk.
Executive priority
Treat as a near-term remediation item for affected WordPress sites, especially those with public registration or stored AI keys. Prioritize key rotation and plugin update verification over emergency response unless local evidence shows abuse.
Technical view
CVE-2026-1927 is a missing authorization issue in greenshift_app_pass_validation() in Greenshift – animation and page builder blocks up to and including 12.6. Authenticated Subscriber+ users can retrieve plugin settings and modify settings, including custom_css, enabling stored XSS. CVSS is 5.4, CWE-862. Sources note version 12.6 only partially patched the issue.
Likely exposure
Exposure is limited to WordPress sites running the Greenshift plugin version 12.6 or earlier, where an attacker can authenticate as Subscriber or higher. Public user registration, weak account governance, or many low-privilege accounts increase likelihood.
Exploitation context
No KEV listing and no provided source claims active exploitation. Exploitation requires authenticated access but no user interaction. Potential impact includes disclosure of stored AI API keys and persistent script injection through plugin settings.
Researcher notes
The key issue is missing capability enforcement around greenshift_app_pass_validation(). The source bundle indicates partial remediation in 12.6 while still describing versions through 12.6 as affected. Confirm the final fixed version from vendor or repository history before closing findings.
Mitigation direction
- Update Greenshift to the latest available version and review vendor guidance for complete remediation.
- If AI API keys were stored in the plugin, rotate them promptly.
- Restrict or disable public user registration where it is not required.
- Review and remove unnecessary Subscriber or higher accounts.
- Inspect Greenshift global settings for unexpected custom_css or unauthorized changes.
Validation and detection
- Inventory WordPress sites using Greenshift and identify versions 12.6 or earlier.
- Confirm whether low-privilege users can exist or self-register on affected sites.
- Review Greenshift settings for stored AI API keys and unexpected custom_css content.
- Check administrative logs for suspicious plugin setting changes by low-privilege accounts.
- Verify remediation against Wordfence and WordPress plugin repository change history.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1927 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N2.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2128db-ca9f-4211-8bc5-01a2cc1cba64?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset/3441535/greenshift-animation-and-page-builder-blocks/trunk/init.phpCVE reference
- https://plugins.trac.wordpress.org/changeset/3441609/greenshift-animation-and-page-builder-blocksCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.