What is the CVSS score of CVE-2026-24547?

CVE-2026-24547 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

SiteGround Email Marketing CVE-2026-24547

EUVD-2026-39781 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-c879-9r2p-425r

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no credentials or complexity; scope unchanged and impact limited to integrity only, consistent with unauthorized action execution without data leakage.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:05 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

AnalysisAI

Broken access control in the SiteGround Email Marketing WordPress plugin (versions 1.7.5 and earlier) permits unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862). The CVSS vector confirms network-accessible, low-complexity, zero-privilege exploitation with an integrity-only impact, meaning attackers can manipulate plugin-managed data or functionality without logging in. No active exploitation has been confirmed at time of analysis, and no public exploit code has been identified.

Technical ContextAI

The SiteGround Email Marketing plugin for WordPress contains one or more endpoints or AJAX handlers that fail to enforce authorization before executing sensitive operations - a classic CWE-862 (Missing Authorization) pattern. WordPress plugins are expected to gate privileged functionality using capability checks such as current_user_can() paired with nonce verification (wp_verify_nonce()); the absence of these controls is what Patchstack classifies under the Authentication Bypass tag. The vulnerability affects all plugin versions up to and including 1.7.5. The CVSS base vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over the network without any credentials or user interaction, consistent with exposed WordPress REST API routes or admin-ajax.php handlers that lack proper permission callbacks.

RemediationAI

Administrators should update the SiteGround Email Marketing plugin to a version beyond 1.7.5 immediately upon availability. The exact patched version is not confirmed in the available intelligence data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/siteground-email-marketing/vulnerability/wordpress-siteground-email-marketing-plugin-1-7-5-broken-access-control-vulnerability and the WordPress plugin repository for the latest release. If an update is not yet available, a compensating control is to deactivate the plugin entirely until a fix ships - this eliminates the attack surface with no partial-mitigation trade-offs. Alternatively, a web application firewall (WAF) rule blocking unauthenticated POST requests to the plugin's specific AJAX or REST endpoints can reduce exposure, though the exact endpoint names are not confirmed in available data and this approach requires testing to avoid breaking legitimate functionality.