EUVD-2026-64798
GHSA-mccc-xw5w-5xh6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-accessible, low-complexity exploit requiring subscriber authentication; high integrity impact from unauthorized privileged writes, no confidentiality loss, minor availability disruption.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
AnalysisAI
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at minimum subscriber-level privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 (High) score reflects network exposure (AV:N), low attack complexity (AC:L), low required privileges (PR:L - subscriber level), no user interaction (UI:N), high integrity impact (I:H), and low availability impact (A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update ProLancer Element to a version beyond 1.4.8 once a patched release is confirmed available from themebing; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/prolancer-element/vulnerability/wordpress-prolancer-element-plugin-1-4-8-broken-access-control-vulnerability should be monitored for the exact fix version, which has not been independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your WordPress subscriber user base and verify all installations running ProLancer Element v1.4.8 or earlier are identified. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prolancer Element
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today