Nelio AB Testing CVE-2026-40742

No special conditions - remote unauthenticated exploitation against default configurations of Nelio AB Testing plugin versions <=8.2.8. The vulnerability is accessible via standard HTTP requests to WordPress REST API or admin-ajax endpoints. Limits: only confidentiality of A/B testing data is impacted; no ability to modify or delete data, and only versions up to 8.2.8 are vulnerable.

CVSS 3.1 score 5.3 (medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates network-based, low-complexity exploitation without authentication or user interaction, but only low confidentiality impact. EPSS score is 0.02% (very low probability of exploitation). CISA KEV does not list this CVE. SSVC analysis shows no current exploitation, automatable, partial technical impact. The combination of low EPSS, no KEV, and no public POC suggests this is a lower-priority issue despite the easy attack vector. However, the automatable nature means if exploitation were to begin, it could spread quickly. Data gaps: no direct vendor advisory confirming a patched version, but references point to Patchstack.

An unauthenticated attacker identifies a WordPress site running Nelio AB Testing <=8.2.8. By sending a crafted HTTP request to a vulnerable REST endpoint (e.g., /wp-json/nelio-ab-testing/v1/experiments), the attacker retrieves sensitive A/B test configuration data, including experiment names, user segments, and performance metrics. No public exploit code is currently available.