What is the CVSS score of CVE-2026-28155?

CVE-2026-28155 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Do Lasso CVE-2026-28155

EUVD-2026-57948 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-13 Patchstack

GHSA-gcxj-g9hm-45pg

WordPress Authentication Bypass Wordpress Plugin Do Lasso Lasso Analytics Inc

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no credentials or interaction required; impact bounded to partial write-side manipulation with no confidentiality exposure, consistent with CWE-639 write-path IDOR.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:20 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

AnalysisAI

Unauthenticated IDOR in the Do Lasso WordPress affiliate link management plugin (versions 358 and earlier) allows remote attackers without any credentials to reference and manipulate internal objects by supplying attacker-controlled identifier values, resulting in unauthorized modification or disruption of affiliate link data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default plugin installations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-privilege requirement lower the barrier to opportunistic abuse.

Technical ContextAI

Do Lasso (CPE: cpe:2.3:a:lasso_analytics,_inc.:do_lasso:*:*:*:*:*:*:*:*) is a WordPress plugin by Lasso Analytics, Inc. used for affiliate link management and monetization. The root cause is CWE-639 (Authorization Through User-Controlled Key): the plugin exposes endpoints that accept user-supplied identifiers - such as numeric IDs referencing affiliate links or plugin-managed objects - and acts on them without verifying whether the requesting party is authorized to access or modify the referenced resource. Because WordPress REST API endpoints and AJAX handlers can be reachable without authentication, a plugin that fails to enforce object-level ownership checks before processing these IDs creates a direct path for unauthenticated manipulation. The scope-unchanged (S:U) rating and C:N/I:L/A:L impact suggest the affected operations allow partial modification or deletion of plugin-controlled data rather than full site compromise or credential disclosure.

RemediationAI

Update the Do Lasso plugin to a version above 358 via the WordPress dashboard (Plugins → Updates) or by downloading the latest release from the WordPress plugin repository; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/lasso/vulnerability/wordpress-do-lasso-plugin-358-insecure-direct-object-references-idor-vulnerability should be consulted for the confirmed fixed version number, which is not independently specified in the available intelligence. If an immediate upgrade is not possible, a compensating control is to use a Web Application Firewall (WAF) rule - Patchstack and similar WordPress security plugins offer virtual patches that block exploitation at the request layer without modifying plugin code, though this introduces a dependency on rule accuracy and does not fix the underlying flaw. Additionally, restricting unauthenticated access to WordPress AJAX and REST API endpoints at the server or firewall level can reduce the attack surface, but may break legitimate plugin functionality and requires careful scoping.