What is the CVSS score of CVE-2026-25403?

CVE-2026-25403 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Ultimate Store Kit CVE-2026-25403

EUVD-2026-53938 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-5m93-65m5-p9q5

WordPress Authentication Bypass Wordpress Plugin Ultimate Store Kit Elementor Addons Bdthemes

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable WordPress endpoint requiring no authentication (PR:N, AV:N); limited partial read/write impact with no availability consequence and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:58 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

AnalysisAI

Broken access control in Ultimate Store Kit Elementor Addons versions up to and including 3.0.5 allows unauthenticated remote attackers to perform unauthorized read and write operations against WordPress store functionality. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX actions, enabling bypass of intended access restrictions without any credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, AC:L) makes opportunistic exploitation straightforward once the specific vulnerable endpoint is identified.

Technical ContextAI

Ultimate Store Kit Elementor Addons is a WordPress plugin developed by BDThemes (CPE: cpe:2.3:a:bdthemes:ultimate_store_kit_elementor_addons) that extends the Elementor page builder with WooCommerce-oriented store widgets and functionality. CWE-862 (Missing Authorization) identifies the root cause: one or more of the plugin's registered WordPress REST API routes, admin-ajax handlers, or action hooks lack capability checks (e.g., current_user_can()) before executing sensitive operations. In WordPress plugin development, this is a common pattern failure where developers register endpoints without pairing them with nonce verification or user role validation, leaving them reachable by any unauthenticated HTTP client. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the endpoint is network-accessible with no authentication prerequisite and no special attack complexity.

RemediationAI

Update Ultimate Store Kit Elementor Addons to a version released after 3.0.5 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. A patched version higher than 3.0.5 is expected per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-3-0-5-broken-access-control-vulnerability; however, an exact fix version number was not confirmed in the available input data and should be verified against the Patchstack advisory before upgrading. If an immediate update is not possible, a compensating control is to temporarily disable the plugin entirely, accepting loss of store kit widget functionality. Web application firewall (WAF) rules targeting unauthenticated requests to the plugin's specific AJAX actions or REST endpoints can provide partial mitigation but require knowledge of the exact vulnerable endpoint, which is not enumerated in available data.