Skydropx Plugin CVE-2026-108480

Exploitation requires the Skydropx WordPress plugin (version n/a through 2.1.4) to be installed and active on an internet-reachable WordPress site; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed, so default installations are exposed. The description attributes the issue to 'Incorrectly Configured Access Control Security Levels,' meaning the vulnerable endpoint lacks a proper capability/authorization check rather than requiring a non-default setting. The primary limiting factors are simply the presence of the vulnerable plugin version and network reachability of the WordPress instance; impact is bounded to high confidentiality exposure with only limited integrity impact and no availability impact.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2 High) describes a remotely reachable, low-complexity, unauthenticated missing-authorization flaw (CWE-862) in the Skydropx WordPress plugin, with high confidentiality impact and limited integrity impact. All signals are internally consistent - PR:N aligns with the 'Incorrectly Configured Access Control' / broken-access-control description, and no scope change (S:U) is claimed. However, several key exploitation signals are entirely absent from the provided data: there is no EPSS probability score, no CISA KEV listing, and no indication of public POC or exploit code. Per the precision rules this is therefore 'no public exploit identified at time of analysis' - the 8.2 score reflects theoretical severity, not demonstrated real-world exploitation. Given that the sole source is a Patchstack research advisory for a niche shipping-integration plugin (no vendor confirmation, no active-exploitation intelligence), this currently reads as a credible-but-not-yet-prioritized issue: high CVSS driven by the unauthenticated network vector, but no evidence of widespread or targeted attacks. Patch status is also not stated in the input beyond the affected range 'n/a through 2.1.4', so a fixed version cannot be confirmed from the data provided.

A remote, unauthenticated attacker sends crafted HTTP requests directly to an unprotected plugin endpoint or AJAX action that fails to verify the caller's authorization, retrieving sensitive data (e.g., shipping, order, or account information) that should be access-controlled. The low attack complexity (AC:L) and lack of required privileges or user interaction mean exploitation needs only network reachability to the WordPress site. No public exploit code is identified in the provided data, so any current exploitation would require an attacker to independently discover the vulnerable request.