EUVD-2026-93077
GHSA-4qhg-9xvf-2433
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running picu ≤ 3.10.1
-
ExploitSend crafted request to unprotected plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactAccess or modify restricted functionality/data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the picu plugin at version 3.10.1 or earlier and have the vulnerable plugin endpoint reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are required - exploitation works against default installations. The primary limiting factors are deployment scope (picu is a specialized client-proofing plugin with a small install base) and the bounded impact (Low confidentiality, integrity, and availability), rather than any access prerequisite. The exact protected action gated by the missing authorization check is not specified in the available data. |
| Impact | Signals are modest and largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 7.3 HIGH, indicating remote, unauthenticated, low-complexity exploitation with no user interaction - but all three impact metrics are Low (C:L/I:L/A:L), so the real-world damage per request is bounded rather than catastrophic. CWE-862 (Missing Authorization) aligns with the 'Unauthenticated Broken Access Control' description. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of an easy-to-reach vector but only partial (Low) impact, in a niche photography-proofing plugin, points to a genuine but lower-priority issue rather than a critical emergency - patch on a normal cadence unless picu is deployed on an exposed, high-value WordPress site. Note the description lacks detail on exactly which protected function or data the broken access control exposes, so the concrete consequence cannot be confirmed from the available data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request directly to a picu plugin endpoint on a WordPress site, bypassing the authorization check that should gate the action, and reaches functionality or data intended only for authorized users. Because no authentication or user interaction is required, this can be scripted against any reachable site running picu <= 3.10.1. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated requests to the WordPress picu plugin (versions up to and including 3.10.1) can reach plugin functionality that is supposed to be protected by an authorization check, letting any remote visitor perform an action the plugin intended to reserve for a privileged or otherwise authorized user. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, with Low confidentiality, integrity and availability impact and S:U) confirms that no credentials, no user interaction and no non-default configuration are required, so any reachable installation is exposed, though the resulting impact is bounded rather than a full site takeover - the specific protected action gated by the missing check is not identified in the available data. There is no public exploit identified at time of analysis and no CISA KEV listing; real-world risk is constrained mainly by the small install base of this specialized client-proofing plugin and by the Low severity of each impact metric.
RemediationAI
No fixed version is listed in the supplied advisory metadata, so patch status is not confirmed from the available data - check the picu plugin's WordPress.org changelog and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/picu/vulnerability/wordpress-picu-plugin-3-10-1-broken-access-control-vulnerability?_s_id=cve for a released fixed version and update the plugin as soon as one is published. If picu is not essential to day-to-day operations, the most reliable mitigation is to deactivate and remove the plugin entirely, which eliminates the exposure but forfeits its client-proofing and gallery workflow; where the plugin must stay active, block or restrict access to the vulnerable picu endpoint with a reverse-proxy or WAF rule that rejects anonymous requests, accepting the trade-off that legitimate unauthenticated front-end features (such as client-facing proofing links) may break and that rule maintenance is required. Additional compensating controls include fronting the site with an authentication layer, disabling unused plugin REST routes via a rest_endpoints filter, and enabling verbose access logging plus monitoring for unexpected state changes in picu-managed content, while noting that these reduce exploitability but do not correct the underlying missing authorization check.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-862 (Missing Authorization) in a WordPress plugin, meaning the affected code path performs its intended function without first verifying that the caller holds the required capability or has passed the plugin's intended access gate. WordPress's security model relies on explicit checks - current_user_can() capability tests, nonce verification, and REST API permission_callback functions (or AJAX handlers being hooked to wp_ajax_* rather than unauthenticated wp_ajax_nopriv_* actions) - and any endpoint that omits these is reachable by anonymous HTTP requests just as easily as by logged-in users. The CPE cpe:2.3:a:picu:picu:*:*:*:*:*:*:*:* identifies picu itself as the affected component, and EUVD-2026-93077 records the affected range as picu through version 3.10.1, matching the reported '<= 3.10.1' boundary. Because the CVSS vector carries PR:N and UI:N with a network attack vector, the vulnerable entry point is directly reachable over HTTP with no prior foothold; the Low CIA ratings indicate the exposed action manipulates limited plugin-managed data rather than offering code execution or administrative takeover. The exact endpoint and the exact privileged action behind the missing check are not specified in the supplied intelligence, so defenders should enumerate picu's registered REST routes and admin-ajax actions on a test install to determine which one lacks an authorization guard.
Know when Picu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Unauthenticated remote broken access control gives AV:N/AC:L/PR:N/UI:N; impact is partial across C/I/A (Low) as the exposed function is scoped, not full system compromise.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Executive ViewAI
The picu plugin for WordPress (versions up to and including 3.10.1) contains an authorization flaw that allows any anonymous visitor to trigger a privileged plugin action, exposing every reachable site running this client-proofing tool. Because no credentials or user interaction are required, any internet-facing installation is exposed by default, meaning marketing, creative, and agency teams that rely on picu for client image review may face unauthorized content or workflow changes. The exposure is bounded - impact metrics are Low and a specialized install base limits reach - but leadership should care because remediation depends on an unpatched third-party component sitting on customer-facing infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the picu plugin if not business-critical; restrict access to picu plugin endpoints via authenticating reverse proxy, WAF virtual patching, or IP allowlisting/VPN; monitor and review logs for unauthenticated requests to picu routes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated cross-site scripting in the picu WordPress plugin (versions up to and including 3.10.1) allows remote at
Stored cross-site scripting in the picu WordPress plugin (all versions up to and including 3.5.1) lets an attacker injec
Exploit-DB