EUVD-2026-57950
GHSA-36hp-4q45-jxjc
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exploitable by authenticated subscribers (PR:L); AC:H reflects path enumeration complexity; S:U as impact stays within WordPress application boundary.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Path Traversal in Do Lasso <= 358 versions.
AnalysisAI
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at minimum subscriber-level privileges on the target site - the lowest WordPress role, granted to any registered user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 reflects high CIA impact but is moderated by Attack Complexity: High and Privileges Required: Low (subscriber-level authentication). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Do Lasso plugin to a version above 358 through the WordPress admin dashboard or wp-cli (wp plugin update lasso). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress instances running Do Lasso plugin and disable it if version 358 or earlier is detected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in the Do Lasso WordPress plugin (versions ≤ 358) allows authenticated subscribers to execute arbitrary da
Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scrip
Unauthenticated IDOR in the Do Lasso WordPress affiliate link management plugin (versions 358 and earlier) allows remote
Same weakness CWE-35 – Path Traversal: '.../...//'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today