What is the CVSS score of CVE-2026-3570?

CVE-2026-3570 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-3570?

Organizations using for WordPress is vulnerable to unauthorized access in all should be aware of moderate risk from CVE-2026-3570, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-3570?

Within 30 days: Identify affected systems running for WordPress is vulnerable to unauthorized access in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-3570

EUVD-2026-14015 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-294q-4m4m-vwq9

WordPress PHP Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14015

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for unauthenticated attackers to reset all plugin configuration and delete all per-page/per-post analytics settings via the 'reset' parameter.

AnalysisAI

The Smarter Analytics WordPress plugin (all versions up to 2.0) contains an authentication bypass vulnerability that allows unauthenticated attackers to reset plugin configuration and delete all analytics settings via the 'reset' parameter in the global scope of smarter-analytics.php. This is a missing authentication and capability check vulnerability (CWE-862) with a CVSS score of 5.3, classified as moderate severity with low attack complexity and no authentication required. The vulnerability is publicly documented via Wordfence threat intelligence with direct references to the vulnerable code in the WordPress plugin repository, though no active exploitation in the wild or public proof-of-concept has been widely reported.

Technical ContextAI

The vulnerability exists in the Smarter Analytics plugin for WordPress (CPE cpe:2.3:a:acumenconsulting:smarter_analytics:*:*:*:*:*:*:*:*), a PHP-based WordPress plugin that provides analytics tracking functionality. The root cause is classified as CWE-862 (Missing Authorization), specifically the absence of authentication and WordPress capability checks on the 'reset' parameter handler in the plugin's main file (smarter-analytics.php at line 27). WordPress plugins typically handle configuration actions through admin AJAX endpoints or backend pages that execute wp_verify_nonce() and current_user_can() checks to ensure only authorized administrators can modify settings. This plugin fails to implement these standard WordPress security functions in the global scope, allowing any HTTP request—including those from completely unauthenticated users—to trigger destructive configuration reset operations. The vulnerability operates in the global PHP scope rather than being confined to an authenticated admin context.

RemediationAI

Update the Smarter Analytics plugin to a version newer than 2.0 as soon as a patch is released by the plugin maintainers; check the WordPress plugin repository or contact the vendor Acumen Consulting for availability. Until a patch is released, WordPress site administrators should either deactivate and remove the Smarter Analytics plugin entirely if analytics data is not critical, or implement network-level access controls to restrict POST/GET requests containing the 'reset' parameter to trusted IP ranges only. As a temporary mitigation, a WordPress web application firewall (WAF) plugin or reverse proxy rule can be configured to block requests with the 'reset' parameter from non-authenticated users. Additionally, ensure WordPress core, themes, and other plugins are fully patched and up to date, and consider implementing a content security policy to limit unexpected administrative actions.