Medium · 6.5 CVE-2025-58986 EUVD-2025-38136GHSA-5qc6-qfj6-rfxv

WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerability

Published Nov 6, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: ganddser Product: Jock On Air Now (JOAN)

Description

Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jock On Air Now (JOAN): from n/a through <= 6.0.4.

Affected products

Vendor	Product	Affected	Fixed
ganddser	Jock On Air Now (JOAN)	≤ 6.0.4	—

References

https://patchstack.com/database/Wordpress/Plugin/joan/vulnerability/wordpress-jock-on-air-now-joan-plugin-6-0-4-broken-access-control-vulnerability?_s_id=cve vdb-entry