9.9Critical

CVE-2026-22192Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage

Voltronic Power SNMP Web Pro Published: 2026-03-13 04:18 (8 months ago)

Description

Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.

Weakness (CWE): CWE-306

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
gvectors	wpdiscuz	< 7.6.47
Voltronic Power	SNMP Web Pro	1.1
voltronicpower	snmp web pro	1.1

References and patches

https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt technical-description
https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/ technical-description
https://voltronicpower.com/ product
https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage third-party-advisory

CPE matches (NVD) (1)

cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:* < 7.6.47

CVSS score

9.9Critical

Source: VulnCheck · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: Low
Integrity: High
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

All scores (5)

cna	CVSS 4.0	8.8High
cna	CVSS 3.1	9.9Critical
disclosure@vulncheck.com	CVSS 4.0	8.8High
disclosure@vulncheck.com	CVSS 3.1	9.9Critical
nvd	CVSS 3.1	5.4Medium

EPSS (chance of exploitation in 30 days)

0.31%

higher than 24% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-01-06
Published2026-03-13 04:18
Reached IP-DB2026-10-24 23:46
Last updated2026-07-14 18:53

Assigned by (CNA): VulnCheck
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

6.5Medium

CVE-2026-125796 2 hours ago

WordPress JS Help Desk plugin <= 5.0.5 - Broken Access Control vulnerability

Ahmad JS Help Desk

Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.5.

7.1High

CVE-2026-125760 2 hours ago

WordPress Bit Assist plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability

Bit Apps Bit Assist

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Apps Bit Assist bit-assist allows DOM-Based XSS.This issue affects Bit Assist: from n/a through 1.8.4.

7.1High

CVE-2026-125804 2 hours ago

WordPress AI Engine plugin <= 3.9.3 - Cross Site Scripting (XSS) vulnerability

Meow Apps AI Engine

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.3.

7.1High

CVE-2026-125818 2 hours ago

WordPress wpDiscuz plugin <= 7.6.75 - Cross Site Scripting (XSS) vulnerability

AdvancedCoding wpDiscuz

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.75.

7.5High

CVE-2026-125823 2 hours ago

WordPress Gutenverse plugin <= 4.2.2 - Denial of Service Attack vulnerability

Jegstudio Gutenverse

Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.This issue affects Gutenverse: from n/a through 4.2.2.

5.0Medium

CVE-2026-125826 2 hours ago

WordPress PowerPress Podcasting plugin <= 11.18.3 - Arbitrary File Deletion vulnerability

Blubrry Podcasting PowerPress Podcasting

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Path Traversal.This issue affects PowerPress Podcasting: from n/a through 11.18.3.