Which versions of Wordpress Plugin are affected by CVE-2026-33508?

Parse Server deployments using LiveQuery are vulnerable to denial-of-service attacks where attackers can crash or severely degrade application availability by sending malicious WebSocket requests.. A patch is available.

How to fix or mitigate CVE-2026-33508?

Within 24 hours: identify all Parse Server instances with LiveQuery enabled and assess internet exposure; temporarily restrict WebSocket access to trusted networks if possible. Within 7 days: apply the vendor patch across all affected Parse Server deployments in a staged rollout. Within 30 days: complete patch deployment to all environments and validate through performance testing.

Wordpress Plugin CVE-2026-33508

Q: What is the CVSS score of CVE-2026-33508?

CVE-2026-33508 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13917 HIGH

Uncontrolled Recursion (CWE-674)

2026-03-20 https://github.com/parse-community/parse-server

GHSA-6qh5-m6g3-xhq6

GHSA-96qp-8cmq-jvq8

GHSA-hgx2-28f8-6g2r

GHSA-r7mc-x6x7-cqxx

GHSA-v2hr-chj5-35fh

WordPress Information Disclosure Wordpress Plugin

8.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 22:00 euvd

EUVD-2026-13917

Analysis Generated

Mar 20, 2026 - 22:00 vuln.today

Patch released

Mar 20, 2026 - 22:00 nvd

Patch available

CVE Published

Mar 20, 2026 - 21:48 nvd

HIGH 8.2

DescriptionGitHub Advisory

Impact

Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.

Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.

Patches

The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same requestComplexity.queryDepth limit that already protects REST API queries.

Workarounds

There is no known workaround other than upgrading.

AnalysisAI

Parse Server's LiveQuery component fails to enforce query depth limits on WebSocket subscription requests, allowing attackers to send deeply nested logical operators that trigger excessive recursion and CPU consumption. This affects Parse Server deployments where the LiveQuery WebSocket endpoint is accessible to untrusted clients (pkg:npm/parse-server). A patch is available from the vendor with no known workarounds, and while no EPSS score or KEV listing is present, the availability of proof-of-concept code in the patch references suggests exploitation details are publicly documented.

Technical ContextAI

Parse Server is an open-source Backend-as-a-Service framework for Node.js (npm package parse-server) that provides REST and LiveQuery APIs for real-time database synchronization. The vulnerability stems from CWE-674 (Uncontrolled Recursion), where the LiveQuery WebSocket subscription handler fails to validate query condition depth using the existing requestComplexity.queryDepth configuration setting. While REST API queries already enforce this limit to prevent resource exhaustion attacks, the WebSocket-based LiveQuery component bypassed this validation, allowing arbitrarily deep nesting of logical operators (AND, OR, NOR) that cause recursive processing. This architectural inconsistency between the REST and WebSocket handlers created an attack surface for algorithmic complexity exploitation.

RemediationAI

Upgrade Parse Server to the patched version as detailed in the vendor security advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6, with specific patch implementations available in pull requests https://github.com/parse-community/parse-server/pull/10259 and https://github.com/parse-community/parse-server/pull/10260. The vendor explicitly states there is no known workaround other than upgrading, meaning temporary mitigations are not viable. Until patching is completed, consider restricting network access to the LiveQuery WebSocket endpoint through firewall rules, IP allowlists, or authentication requirements to limit exposure to trusted clients only, though this may impact legitimate functionality.