Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-24560 EUVD-2026-4246GHSA-9fhq-9fx7-9f4h

WordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerability

Published Jan 23, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cloudinary: from n/a through <= 3.3.2.

Affected products

VendorProductAffectedFixed
Cloudinary Cloudinary ≤ 3.3.2 —

References