← Back to the live CVE advisory feed

CVE-2026-56710: Product identification pending

Severity

9.3 (CRITICAL)

Affected versions

Before 1.0.16

Fixed version

1.0.16

Patch status

Patched

Published

2026-08-25T02:16:43.073

Modified

2026-08-25T16:16:56.343

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions.

View the official NVD record for CVE-2026-56710

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.