EUVD-2026-93274
GHSA-fmv7-xw6m-9jpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain Subscriber account
-
DeliveryAuthenticate to WordPress
-
ExploitSend resource-exhausting plugin requests
-
ExecutionExhaust server resources
-
ImpactSite denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account at Subscriber level or higher (CVSS PR:L), so the site must permit account registration or the attacker must already hold credentials - this is the primary limiting factor, meaning sites with registration disabled are not exposed to anonymous attackers. The affected component is the WPBase Cache plugin at versions 5.5.6 and earlier; sites not running this plugin are unaffected. No special non-default configuration or user interaction is indicated (UI:N, AC:L), and impact is limited to availability (A:H) with no confidentiality or integrity consequence. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 (Medium) and tells a consistent story: a network-reachable, low-complexity attack requiring only low privileges (PR:L - a Subscriber-level account, the lowest WordPress authenticated role) and no user interaction, impacting availability only (A:H) with no confidentiality or integrity effect. The signals align - this is a pure denial-of-service issue consistent with the CWE-770 (Allocation of Resources Without Limits or Throttling) classification. No EPSS score was supplied in the input, no CISA KEV listing is present, and no public proof-of-concept is indicated, so exploitation probability cannot be quantified from the data provided and should be treated as no public exploit identified at time of analysis. The practical priority is moderate: exploitation requires a valid authenticated account (even if only Subscriber), which limits exposure on sites that do not permit open registration, and the impact is confined to availability with no data compromise. This is a genuine but bounded issue rather than a critical remote-code-execution emergency - a 'high-reach-metric but availability-only, low-privilege-gated' DoS. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running WPBase Cache 5.5.6 or earlier, then issues requests that trigger unbounded resource consumption in the plugin, exhausting server resources and rendering the site unavailable to legitimate users. Because the CVSS vector is AC:L/UI:N, the action is low-complexity and requires no victim interaction. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Denial of service in the WordPress plugin WPBase Cache (versions 5.5.6 and earlier) allows an authenticated user holding the Subscriber role - the lowest authenticated WordPress role - to consume server resources without limit and degrade or take the site offline. The attack is network-reachable, low complexity, requires no user interaction, and affects only availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium), so sites that have disabled user registration or that do not run the plugin are not exposed to anonymous attackers. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure depends on whether the target site permits self-registration or an attacker already holds subscriber credentials. Reported by Patchstack, with no vendor-fixed version confirmed in the available advisory data.
RemediationAI
The available intelligence does not identify a vendor-released fixed version, so the first step is to check the WordPress plugin repository and the vendor's site for a WPBase Cache release newer than 5.5.6 and apply it immediately if one exists; if no update has shipped, treat 5.5.6 and earlier as unpatched (vendor advisory reference: https://patchstack.com/database/wordpress/plugin/wpbase-cache/vulnerability/wordpress-wpbase-cache-plugin-5-5-6-denial-of-service-attack-vulnerability?_s_id=cve). The most effective interim control is to remove or deactivate WPBase Cache until a fix is available - the trade-off is loss of page caching and a resulting increase in origin load, which can be offset with a maintained alternative caching plugin. Because exploitation requires only Subscriber-level access (PR:L), disable open user registration and audit existing low-privilege accounts if the site does not legitimately need them; the side effect is that legitimate self-service signups and non-privileged contributor workflows stop working. Where registration cannot be disabled, front the site with a reverse proxy or WAF that rate-limits and caps concurrent requests per authenticated session and per source IP, and set PHP-FPM pool limits, memory limits, and request timeouts so a single abusive session cannot monopolize workers; these controls add latency and can throttle legitimate traffic spikes. Finally, alert on sustained per-account request bursts and unusual cache-write volumes so a resource-exhaustion attempt is detected before the site becomes unavailable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) in WPBase Cache, a WordPress caching plugin published by vendor 'baseapp' (CPE cpe:2.3:a:baseapp:wpbase_cache, version scope open-ended, covering 5.5.6 and below). Caching plugins sit in the request path of virtually every page load - they intercept WordPress bootstrap/cache hooks, write cache entries, and manage purge and storage routines - which means any plugin endpoint or routine that allocates memory, file handles, database rows, or cache entries per request without a cap can be driven to exhaust the pool. Because the vulnerability is a resource-exhaustion class rather than an injection or memory-safety bug, there is no confidentiality or integrity impact (C:N/I:N); the sole consequence is availability loss (A:H), where the process, PHP-FPM pool, or backing datastore becomes saturated and legitimate requests fail. The CVSS vector (PR:L) indicates the trigger path sits behind WordPress authentication and is reachable by any logged-in account, which is why the Subscriber role - normally considered harmless - becomes the effective attack primitive. The vector reports UI:N and AC:L, meaning no special victim action or non-default configuration is needed beyond an account and a site running the affected plugin.
Know when Wpbase Cache gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable DoS triggerable by a low-privilege Subscriber account (PR:L), no user interaction, affecting availability only; matches the resource-exhaustion nature of CWE-770.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB