Is CVE-2026-4117 actively exploited?

No active exploitation of CVE-2026-4117 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4117 be exploited remotely?

Yes. CVE-2026-4117 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-4117?

CVE-2026-4117 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-4117

MEDIUM

CVE-2026-4117

CWE-862Published: April 22, 2026· Updated: Apr 22, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.4th

Official Description

The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5. This is due to a missing capability check in the CalJSettingsPage class constructor, which processes the 'save-obtained-key' operation directly from POST data without verifying that the requesting user has the 'manage_options' capability, and without any nonce verification. The plugin bootstrap file (calj.php) instantiates CalJSettingsPage whenever is_admin() returns true, which is the case for any authenticated user making requests to wp-admin URLs (including admin-ajax.php). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API key setting and clear the Shabbat cache, effectively taking control of the plugin's API integration.

NVD Source

Technical Analysis

CVE-2026-4117 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.