Support Board CVE-2026-27395

No special conditions - remote unauthenticated exploitation against default configurations of the Support Board WordPress plugin at any version below 3.8.9 (CVSS AV:N/AC:L/PR:N/UI:N). Limiting factors: the target WordPress site must have the Support Board plugin installed and activated (it is not a core WordPress component), the plugin version must be earlier than 3.8.9, and the vulnerable plugin endpoints (typically admin-ajax.php actions or REST routes) must be reachable from the attacker's network position - sites that gate /wp-admin/ or REST routes behind IP allow-lists, authentication proxies, or aggressive WAF rules reduce exposure even on vulnerable versions.

Real-world risk is high and should be treated as priority remediation. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates remote, low-complexity, unauthenticated exploitation with full impact to confidentiality, integrity, and availability - the classic pre-auth-to-admin profile that attackers automate against WordPress plugins. The vulnerability is NOT currently listed in CISA KEV, and no EPSS score or public POC was provided in the input, so we have no public exploit identified at time of analysis. However, Patchstack-reported WordPress plugin privilege-escalation flaws are routinely incorporated into mass-scanning toolkits within days of disclosure, and the unauthenticated nature combined with the plugin's role (handling external customer interactions, often exposed at site edges) materially elevates real-world risk above the raw signals. EPSS data is missing from the input - defenders should monitor it as a leading indicator.

An attacker scans the public internet for WordPress sites running Support Board < 3.8.9 (typically fingerprinted via plugin assets or readme.txt), then sends a crafted unauthenticated HTTP request to the vulnerable endpoint to either register a new account with elevated capabilities or promote an existing low-privilege account to administrator. With administrator role obtained, the attacker uploads a malicious plugin or theme containing PHP, achieving arbitrary code execution and persistent site control. No public exploit identified at time of analysis, but the CVSS AC:L profile suggests a straightforward, scriptable request once the vulnerable endpoint is identified.