What is the CVSS score of CVE-2026-24545?

CVE-2026-24545 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

QR Redirector CVE-2026-24545

EUVD-2026-31746 MEDIUM

Missing Authorization (CWE-862)

2026-05-25 Patchstack

GHSA-5359-frvq-63mr

Authentication Bypass Qr Redirector

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:48 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects QR Redirector: from n/a through 2.0.3.

AnalysisAI

Missing authorization in the QR Redirector WordPress plugin (versions through 2.0.3) exposes redirect management functionality to authenticated low-privileged users who lack the appropriate capability checks. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any authenticated WordPress user - including subscribers or contributors - can exploit this flaw remotely without user interaction. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (8th percentile) and SSVC exploitation status of 'none' place this at low operational priority for most environments.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that an authenticated principal holds the required permission before executing a sensitive operation. In WordPress plugin context, this typically manifests as REST API endpoints or admin-ajax handlers that omit capability checks such as current_user_can(), allowing any logged-in user to invoke privileged functions. The CPE string cpe:2.3:a:nikki_blight:qr_redirector identifies this as the 'QR Redirector' plugin authored by Nikki Blight, installed on WordPress sites to manage QR code-to-URL redirect mappings. The integrity impact (I:L) with no confidentiality or availability impact suggests the exploitable function likely allows unauthorized modification of redirect targets - potentially enabling link hijacking within the plugin's managed QR codes.

RemediationAI

Update the QR Redirector plugin to a version beyond 2.0.3 as reported by Patchstack; however, no exact patched release version is independently confirmed from the available data - verify the latest available version via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/qr-redirector/vulnerability/wordpress-qr-redirector-plugin-2-0-3-broken-access-control-vulnerability before deploying. As a compensating control where immediate update is not possible, restrict WordPress site registration and limit low-privilege authenticated roles (subscriber, contributor) on sites where untrusted users may have accounts, reducing the pool of potential exploiters. Alternatively, temporarily deactivating the QR Redirector plugin removes the attack surface entirely at the cost of losing QR redirect functionality.