What is the CVSS score of CVE-2026-27418?

CVE-2026-27418 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Fast Total Search CVE-2026-27418

EUVD-2026-48159 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-fj2f-pc4m-f9w6

WordPress Authentication Bypass Wordpress Plugin Wp Fast Total Search

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated AJAX endpoint with no complexity barrier; only low integrity impact confirmed, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:04 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

AnalysisAI

Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

WP Fast Total Search is a WordPress plugin developed by Epsiloncool (CPE: cpe:2.3:a:epsiloncool:wp_fast_total_search:*:*:*:*:*:*:*:*) that provides full-text search functionality for WordPress sites. CWE-862 (Missing Authorization) indicates the plugin registers one or more WordPress hooks - typically wp_ajax_nopriv_ actions or REST API endpoints - that perform state-modifying operations without calling current_user_can() or an equivalent capability check. This is a common WordPress plugin anti-pattern where AJAX handlers intended to be restricted are inadvertently exposed to unauthenticated visitors. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerable endpoint is network-reachable, requires no authentication, and can be triggered with a straightforward HTTP request.

RemediationAI

Update WP Fast Total Search to any version released after 1.81.282 once a patched release is confirmed by the vendor or Patchstack. Check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fulltext-search/vulnerability/wordpress-wp-fast-total-search-plugin-1-81-282-broken-access-control-vulnerability for the confirmed fix version before upgrading. A specific fix version is not independently confirmed from the available input data, so verify through the WordPress Plugin Directory changelog or the Patchstack page before treating any release as safe. As a temporary compensating control, use a WordPress security plugin (such as Wordfence or Patchstack's virtual patching) to block unauthenticated access to plugin-specific AJAX actions. Alternatively, restrict wp-admin/admin-ajax.php access to authenticated sessions at the web server or WAF level if the plugin's front-end search functionality can tolerate it - note this may break legitimate search widget behavior for visitors.