What is the CVSS score of CVE-2026-14557?

CVE-2026-14557 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of SoftMarket Digital Marketplace are affected by CVE-2026-14557?

The SoftMarket Digital Marketplace WordPress plugin (versions through 1.0.0) contains a critical unauthenticated authentication bypass enabling attackers to take over any verified user account using…

Is there a public PoC exploit available for CVE-2026-14557?

Yes, a public proof-of-concept exploit is available for CVE-2026-14557. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-14557?

Within 24 hours, audit your environment for SoftMarket Digital Marketplace plugin versions 1.0.0 and earlier and immediately deactivate and remove the plugin if not operationally critical; if the plugin must remain active, implement immediate network-level IP whitelisting to restrict access to trusted networks only. Within 7 days, evaluate alternative marketplace solutions and document any potentially compromised accounts; assess breach notification requirements and establish plugin replacement timelines. Within 30 days, subscribe to WordPress plugin security advisories and vendor notifications to enable rapid patching once a fix is released; prepare testing procedures for immediate deployment of the patched version.

SoftMarket Digital Marketplace CVE-2026-14557

EUVD-2026-52171 CRITICAL

Improper Authentication (CWE-287)

2026-08-03 WPScan

GHSA-6gxj-34hr-jj8j

WordPress Authentication Bypass Softmarket Digital Marketplace Unknown

9.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote unauthenticated ID-only bypass yields full account takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H; availability is not impacted (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:23 vuln.today

CVSS changed

Aug 04, 2026 - 18:22 NVD

9.1 (CRITICAL)

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

The SoftMarket - Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.

AnalysisAI

Authentication bypass in the SoftMarket - Digital Marketplace WordPress plugin (versions through 1.0.0) lets remote unauthenticated attackers impersonate any verified user by supplying only that user's numeric ID to a flawed branch of the email-verification flow, resulting in full account takeover. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Despite the critical rating, the EPSS probability is low (0.19%, 9th percentile) and there is no evidence of active exploitation.

Technical ContextAI

The affected component is a WordPress plugin that adds digital-marketplace functionality (vendor accounts, downloadable products) to WordPress sites. The root cause is classified as CWE-287 (Improper Authentication): one branch of the plugin's email-verification handler fails to properly validate the authentication token that is supposed to bind a verification request to its intended recipient. Because the vulnerable code path trusts a user-supplied user ID without cryptographically verifying the accompanying token, the token check can be short-circuited. The CPE identifies the product as cpe:2.3:a:unknown:softmarket_-_digital_marketplace with all versions up to and including 1.0.0 affected; the vendor is listed as unknown in the CPE dictionary, indicating limited authoritative vendor metadata.

RemediationAI

No vendor-released patched version is identified at time of analysis-the affected range extends through 1.0.0 with no fixed version specified in the provided data, so upgrading to a corrected release is not yet a confirmed option. As compensating controls, deactivate and remove the SoftMarket - Digital Marketplace plugin until a fixed version is published, since the vulnerable email-verification flow cannot be safely left reachable; this disables the plugin's marketplace and email-verification functionality entirely. If removal is not feasible, restrict access to the plugin's verification endpoint at the web-server or WAF layer (for example, block or authenticate requests to the email-verification handler and rate-limit requests that iterate user IDs), accepting that this may interfere with legitimate user verification. Monitor for the WPScan advisory (https://wpscan.com/vulnerability/ed5c7632-a307-43f1-bff0-f70977522e2e/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-14557) for an official fixed release, and audit existing user sessions and accounts for signs of unauthorized takeover.