Atomic Edge analysis of CVE-2026-1944 (metadata-based):
This vulnerability is a Missing Authorization flaw in the CallbackKiller service widget plugin for WordPress. The flaw resides in the `cbk_save()` function, which is exposed via the ‘cbk_save_v1’ AJAX action. It allows unauthenticated attackers to arbitrarily update the plugin’s site ID settings. The CVSS score of 5.3 (Medium) reflects an attack that is easy to execute, requires no privileges or user interaction, and results in low integrity impact with no confidentiality or availability loss.
Atomic Edge research identifies the root cause as a missing capability check on the `cbk_save()` function. This is a direct inference from the CWE-862 classification and the vulnerability description. The function is likely registered as an AJAX handler using `wp_ajax_nopriv_{action}` or `add_action(‘wp_ajax_nopriv_{action}’)`. This registration method bypasses WordPress’s standard authentication checks. The absence of a nonce verification or a user capability check like `current_user_can()` before processing the settings update request is the core failure. These conclusions are inferred from the CWE and standard WordPress plugin patterns, as the source code is unavailable for confirmation.
Exploitation involves sending a crafted POST request to the WordPress AJAX endpoint. The target is `/wp-admin/admin-ajax.php`. The attacker must set the `action` parameter to `cbk_save_v1`. The request must also include the specific parameter used by the plugin to store its site ID setting. Based on the function name and common patterns, this parameter is likely named `site_id` or `cbk_site_id`. An attacker would send a request with a malicious value for this parameter, which the vulnerable function would accept and save without validation.
Remediation requires adding proper authorization and security checks to the `cbk_save()` function. The fix must register the AJAX action using `wp_ajax_{action}` instead of `wp_ajax_nopriv_{action}` to enforce user authentication. The function should also implement a capability check, such as verifying the user has the `manage_options` capability. Adding a nonce check using `wp_verify_nonce()` for the incoming request is a standard security practice to prevent CSRF and ensure the request originated from an intended source. These measures would restrict settings updates to authenticated administrators only.
The impact of successful exploitation is unauthorized modification of the plugin’s configuration. While the description specifies modification of the site ID setting, the exact consequences depend on the plugin’s functionality. A manipulated site ID could disrupt the plugin’s core service, causing it to fail or connect to an attacker-controlled server. This could lead to denial of service for the plugin’s intended feature or data leakage if the plugin sends information to the forged ID. The vulnerability does not directly lead to privilege escalation, remote code execution, or site compromise, which aligns with the CVSS metrics of low integrity impact and no availability impact.
