Ezoic WordPress Plugin CVE-2026-32481

No authentication, privileges, or user interaction are required - the CVSS vector (PR:N, UI:N, AC:L, AV:N) confirms this is exploitable by any unauthenticated remote attacker over the network against a default installation of the plugin. The Ezoic plugin must be installed and active on the WordPress site, and the site must be running plugin version 2.22.11 or earlier. No non-default WordPress configuration is implied as a prerequisite. Exploitation is bounded to confidentiality impact only (I:N, A:N) - an attacker cannot modify content or disrupt site availability through this vector alone. The specific endpoint or handler containing the authentication bypass is not disclosed in available public intelligence, which currently limits mass automated exploitation.

The CVSS 3.1 score of 7.5 (High) is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), no privileges or interaction required (PR:N/UI:N), with high confidentiality impact. These metrics are internally consistent with a CWE-288 bypass exposing sensitive data to anonymous HTTP requesters. The scope is unchanged (S:U), limiting blast radius to the affected component rather than the broader WordPress host. No EPSS score is provided in the available intelligence, making probabilistic exploitation likelihood assessment impossible from this dataset. No KEV listing and no POC are referenced, so exploitation status is currently unconfirmed. Given that Ezoic is used by a meaningful population of publishing-focused WordPress sites, the attack surface is real, but the lack of active exploitation signals and the read-only (C:H, I:N, A:N) impact profile suggest this is a genuine high-priority patch target rather than an emergency incident-response trigger.

An unauthenticated attacker identifies a WordPress site running the Ezoic plugin version ≤ 2.22.11 and sends a crafted HTTP request directly to the vulnerable endpoint, bypassing the plugin's authentication check via an alternate code path. The server responds with sensitive data - potentially including API keys, plugin configuration, or site-specific publisher credentials - without requiring any valid session or WordPress login. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and zero-credential requirement suggest a straightforward exploit once the endpoint is mapped.