Do Lasso CVE-2026-28157

Exploitation requires an authenticated WordPress account with at minimum subscriber-level privileges on the target site - the lowest WordPress role, granted to any registered user. This means the attack surface is limited to sites where user registration is enabled (Settings > General > Anyone can register) or where the attacker has otherwise legitimately or illegitimately obtained subscriber credentials. The CVSS AC:H rating indicates additional complexity, which may correspond to a requirement to know or enumerate specific file paths on the server, or to craft a precisely structured request. Sites with closed registration where all subscriber accounts belong to trusted users face substantially reduced risk. The vulnerability does not require administrative or editor access, and no specific plugin feature toggle or non-default configuration beyond the plugin being active is described in available data.

The CVSS 3.1 base score of 7.5 reflects high CIA impact but is moderated by Attack Complexity: High and Privileges Required: Low (subscriber-level authentication). This positions the vulnerability as exploitable only by registered WordPress users - not anonymous visitors - which meaningfully limits the exposed attack surface on sites that do not allow open registration. The AC:H rating indicates exploitation is not straightforward and may require specific conditions such as knowledge of target file paths or a particular request structure. No EPSS data was provided in the intelligence feed, limiting probabilistic exploitation forecasting. There is no CISA KEV listing and no reported POC, suggesting no confirmed active exploitation at time of analysis. Despite the high base score, the real-world priority is primarily elevated for WordPress sites with open user registration or where subscriber accounts may be held by untrusted third parties. Sites with closed registration where all users are trusted face substantially lower practical risk.

An attacker registers a free account on a WordPress site running Do Lasso <= 358 with open user registration enabled, then authenticates as a subscriber and sends a crafted HTTP request to a plugin endpoint with a manipulated file path parameter containing traversal sequences. By escaping the plugin's intended directory boundary, the attacker reads sensitive server files such as wp-config.php (exposing database credentials) or overwrites WordPress core or plugin files to achieve persistent code execution. No public exploit code has been identified at time of analysis, but the Patchstack disclosure provides sufficient vulnerability class detail for skilled researchers to develop one.