What is the CVSS score of CVE-2026-42648?

CVE-2026-42648 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Spectra WordPress Plugin CVE-2026-42648

EUVD-2026-26218 MEDIUM

Missing Authorization (CWE-862)

2026-04-29 Patchstack

WordPress Authentication Bypass Spectra Wordpress Plugin Brainstorm Force

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires authenticated low-privilege session; impact limited to partial confidentiality read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:29 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 11:30 euvd

EUVD-2026-26218

CVE Published

Apr 29, 2026 - 10:40 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.22.

AnalysisAI

Missing authorization checks in the Spectra (ultimate-addons-for-gutenberg) WordPress plugin by Brainstorm Force allow authenticated low-privileged users to access restricted functionality or data beyond their intended permission level. All versions through 2.19.22 are affected, and the CVSS vector (PR:L, C:L) confirms that exploitation requires an existing authenticated session and yields only limited confidentiality exposure. No public exploit code exists and SSVC classifies exploitation status as none, making this a low-urgency but actionable remediation target for WordPress sites with open user registration.

Technical ContextAI

CWE-862 (Missing Authorization) indicates the plugin performs authentication (a user must be logged in) but fails to verify whether that user holds the capability required for a given action - a common WordPress plugin defect where REST API endpoints or AJAX handlers omit a current_user_can() capability check. The affected software is identified by CPE cpe:2.3:a:brainstorm_force:spectra:*:*:*:*:*:*:*:*, covering all releases of the Spectra Gutenberg block-builder add-on. In WordPress, missing capability checks on privileged endpoints can allow subscriber or contributor roles to invoke admin-only operations or read data scoped to higher roles, effectively bypassing role-based access control within the application layer.

RemediationAI

Update the Spectra plugin to a release beyond version 2.19.22 via the WordPress admin dashboard or the WordPress plugin repository. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-19-22-broken-access-control-vulnerability) should be consulted for the confirmed fixed version number, as no specific patched release is independently confirmed from the available data. As a compensating control where immediate patching is not feasible, disable or restrict open user registration on affected WordPress installations to prevent untrusted users from obtaining the authenticated session (PR:L) required for exploitation - note this trade-off limits site functionality for legitimate new users. Sites that require open registration should treat patching as urgent.