What is the CVSS score of CVE-2026-2720?

CVE-2026-2720 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2720?

Organizations using all should be aware of notable risk from CVE-2026-2720, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-2720?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-2720

EUVD-2026-14161 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-wcm8-f742-j3xh

Authentication Bypass WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14161

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive employee information including names, email addresses, phone numbers, salary/pay rates, employment dates, and employment status.

AnalysisAI

The Hr Press Lite WordPress plugin (versions up to 1.0.2) contains a missing capability check vulnerability in the hrp-fetch-employees AJAX action that allows authenticated attackers with Subscriber-level access to retrieve sensitive employee information including names, email addresses, phone numbers, salary data, employment dates, and employment status. This represents a clear privilege escalation and information disclosure flaw with a CVSS score of 6.5 (Medium severity, high confidentiality impact) affecting all versions of the plugin distributed through the WordPress plugin repository.

Technical ContextAI

The vulnerability exists in the WordPress plugin architecture where AJAX actions are registered without proper capability verification. Specifically, the hrp-fetch-employees AJAX handler in Hr Press Lite (as evidenced by the code references in HRP_Action.php line 1444) fails to implement WordPress capability checks (such as current_user_can() with appropriate administrative capabilities) before returning employee data. This falls under CWE-862 (Missing Authorization), a common authorization bypass pattern in WordPress plugin development. The vulnerability affects the plugin identified via CPE cpe:2.3:a:codeclove:hr_press_lite:*:*:*:*:*:*:*:*, indicating all versions across all patch levels are potentially impacted. The root cause is the absence of nonce verification and role-based access control on a sensitive AJAX endpoint that should be restricted to HR administrators only.

RemediationAI

Update Hr Press Lite to a patched version beyond 1.0.2 as provided by the plugin author CodeClove through the WordPress plugin repository. If an update is not immediately available, disable the Hr Press Lite plugin entirely until a patch is released. As a temporary workaround, restrict plugin access by limiting user roles (do not grant Subscriber role to untrusted users) and consider using Web Application Firewall rules to block requests to the hrp-fetch-employees AJAX action if the plugin must remain active. Verify through the WordPress plugin repository and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a63b8e-e16e-4702-be1b-acc5c3e74b22 for the latest patch status and release notes.