What is the CVSS score of CVE-2026-22479?

CVE-2026-22479 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of ThemeRuby Easy Post Submission are affected by CVE-2026-22479?

A missing authorization vulnerability in ThemeRuby Easy Post Submission (versions 2.2.0 and earlier) allows unauthorized users to exploit incorrectly configured access controls.

How to fix or mitigate CVE-2026-22479?

Within 24 hours: Audit access logs for the Easy Post Submission plugin to identify unauthorized submissions and document findings. Within 7 days: Contact ThemeRuby for patch availability timeline and implement temporary access restrictions (disable public submissions or require authentication). Within 30 days: Deploy vendor patch immediately upon release or migrate to alternative plugin with proper authorization controls.

ThemeRuby Easy Post Submission CVE-2026-22479

HIGH

Missing Authorization (CWE-862)

2026-03-05 audit@patchstack.com

Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.2.0.

AnalysisAI

Improper access control in Ruby's ThemeRuby Easy Post Submission plugin through version 2.2.0 allows unauthenticated remote attackers to bypass authorization checks and gain unauthorized read access to sensitive data. The vulnerability stems from misconfigured security levels that fail to properly enforce access restrictions on protected functionality. No patch is currently available for affected installations.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects ThemeRuby Easy Post Submission easy-post-submission. Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.2.0.