What is the CVSS score of CVE-2026-25424?

CVE-2026-25424 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Mediavine Control Panel CVE-2026-25424

EUVD-2026-48148 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-8g9m-xhpx-4cxj

WordPress Authentication Bypass Wordpress Plugin Mediavine Control Panel Mediavine

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Contributor-level authentication required (PR:L); network-accessible with no complexity; integrity-only impact on plugin data, no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:00 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

AnalysisAI

Broken Access Control in the Mediavine Control Panel WordPress plugin (versions <= 2.10.10) permits Contributor-level authenticated users to invoke restricted plugin functionality that should require higher privileges, resulting in unauthorized integrity impacts. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce WordPress capability checks before executing sensitive actions via network-accessible endpoints. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The Mediavine Control Panel is a WordPress plugin used by Mediavine publisher partners for ad configuration and management. CWE-862 (Missing Authorization) indicates the plugin exposes one or more action handlers - typically REST API endpoints or admin-ajax callbacks - without adequate WordPress capability checks (e.g., current_user_can()). WordPress enforces a hierarchical role system (Subscriber < Contributor < Author < Editor < Administrator); this flaw allows the Contributor role to bypass the intended authorization boundary and trigger actions reserved for higher roles. CPE cpe:2.3:a:mediavine:mediavine_control_panel:*:*:*:*:*:*:*:* covers all releases through 2.10.10. This class of vulnerability is among the most commonly reported in WordPress plugins and frequently results from developers adding nonce verification without accompanying capability checks.

RemediationAI

Update the Mediavine Control Panel plugin to a version beyond 2.10.10 as soon as a patched release is confirmed available via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mediavine-control-panel/vulnerability/wordpress-mediavine-control-panel-plugin-2-10-10-broken-access-control-vulnerability. A specific patched version number was not independently confirmed in the available intelligence - verify the latest release before updating. If immediate patching is not feasible, restrict or audit which users on the WordPress installation hold the Contributor role, and disable open site registration if currently enabled. Temporarily deactivating the plugin eliminates the attack surface entirely but will disable ad management functionality for Mediavine publishers.