What is the CVSS score of CVE-2026-102383?

CVE-2026-102383 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

VillaTheme Lookzy CVE-2026-102383

EUVD-2026-92579 MEDIUM

Missing Authorization (CWE-862)

2026-10-05 Patchstack

GHSA-c6p7-6jrr-xc8f

WordPress Authentication Bypass Woocommerce Wordpress Plugin Villatheme Lookzy

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Missing authorization reachable by unauthenticated remote requests (AV:N/AC:L/PR:N/UI:N); impact confined to plugin data modification and disruption (I:L/A:L), with no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Metadata Corrected

Oct 05, 2026 - 19:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 05, 2026 - 19:07 vuln.today

CVE Published

Oct 05, 2026 - 18:08 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.

AnalysisAI

Missing authorization checks (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, versions up to and including 1.1.14, let remote unauthenticated attackers invoke plugin functionality that should be protected by access-control and capability checks. Affected sites are those running the plugin (typically alongside WooCommerce) on internet-reachable WordPress installations; per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions beyond having the Lookzy (woo-lookbook) plugin installed and active on an internet-reachable WordPress site running a version up to and including 1.1.14 - per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote and unauthenticated with no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a medium-severity (CVSS 6.5) Missing Authorization flaw (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, reported by Patchstack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified in the available data for CVE-2026-102383; the advisory at https://patchstack.com/database/wordpress/plugin/woo-lookbook/vulnerability/wordpress-lookzy-plugin-1-1-14-broken-access-control-vulnerability?_s_id=cve should be monitored for a fixed plugin version, and administrators should upgrade as soon as VillaTheme publishes a release beyond 1.1.14. … Detailed patch versions, workarounds, and compensating controls in full report.