What is the CVSS score of CVE-2026-40737?

CVE-2026-40737 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Compe CVE-2026-40737

Q: Which versions of Compe are affected by CVE-2026-40737?

Unauthorized data access in VillaTheme COMPE WordPress plugin versions ≤1.1.4 allows remote attackers to retrieve sensitive information by manipulating user-controlled keys.

EUVD-2026-22892 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-15 Patchstack

GHSA-g5jh-99h2-gm4r

WordPress Authentication Bypass Compe Wordpress Plugin Villatheme

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:37 vuln.today

CVSS changed

Apr 15, 2026 - 16:22 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 15, 2026 - 10:45 euvd

EUVD-2026-22892

CVE Published

Apr 15, 2026 - 10:21 nvd

MEDIUM 5.3

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through <= 1.1.4.

AnalysisAI

Unauthorized data access in VillaTheme COMPE WordPress plugin versions ≤1.1.4 allows remote attackers to retrieve sensitive information by manipulating user-controlled keys. The vulnerability (CWE-639) is trivially exploitable over the network with no authentication, but impact is limited to confidential data exposure. No active exploitation or public exploit is currently known.