CVE-2026-109592 OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements

The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

WordPress OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA plugin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Placement Modification and Entity Metadata Disclosure vulnerability discovered by Wordfence PRISM, OpenStation Team in WordPress Plugin Desktop Mode versions = 1.1.16...