What is the CVSS score of CVE-2026-42661?

CVE-2026-42661 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WP Customer Area are affected by CVE-2026-42661?

A critical access control vulnerability in WP Customer Area WordPress plugin (versions through 8.3.4) enables restricted employees or contractors with limited-privilege plugin access to reach…

How to fix or mitigate CVE-2026-42661?

Within 24 hours: Audit all WordPress installations for WP Customer Area plugin versions through 8.3.4; inventory all users assigned low-privilege custom roles. Within 7 days: Restrict or disable non-essential low-privilege custom role access to the plugin; implement file-access logging and alerting for plugin directories. Within 30 days: Monitor vendor advisory and plugin repository for patch release; plan migration to alternative plugin if no security update within 60 days.

WP Customer Area CVE-2026-42661

EUVD-2026-36826 HIGH

Path Traversal: '.../...//' (CWE-35)

2026-06-15 Patchstack

GHSA-5cvj-q53x-r9m4

WordPress Path Traversal Wp Customer Area Wordpress Plugin Aguilatechnologies

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable over the network via the WordPress site (AV:N/AC:L), requires a plugin custom-role account (PR:L), no user interaction, and arbitrary file read/write yields high CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:59 vuln.today

DescriptionCVE.org

Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.

AnalysisAI

Authenticated path traversal in the WP Customer Area WordPress plugin through version 8.3.4 allows users with low-privilege custom roles to escape intended directory boundaries and access or manipulate files outside the plugin's permitted scope. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable exploitation by authenticated users with high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

WP Customer Area is a WordPress plugin (vendor: Aguila Technologies, CPE cpe:2.3:a:aguilatechnologies:wp_customer_area) that provides private customer portals, file sharing, and per-user content areas inside a WordPress site. The flaw is classified as CWE-35 (Path Traversal: '.../...//'), a subclass of CWE-22 where insufficient normalization of user-supplied path segments allows attackers to traverse upward in the filesystem using dot-dot sequences. In this case the traversal is reachable via functionality exposed to custom roles defined by the plugin, meaning the plugin's own role/capability layer is the trust boundary that is being bypassed for file path inputs.

RemediationAI

Patch available per vendor advisory: upgrade the WP Customer Area plugin to a version newer than 8.3.4 as described in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/customer-area/vulnerability/wordpress-wp-customer-area-plugin-8-3-4-path-traversal-vulnerability); the exact fixed release number is not included in the provided intelligence and should be confirmed against the plugin's WordPress.org page before deployment. Until the update is applied, restrict creation of plugin custom roles and disable open customer self-registration so untrusted users cannot obtain the low-privilege account needed to exploit the flaw (trade-off: blocks legitimate new-customer onboarding through the portal), and place the site behind a WAF rule that blocks path traversal sequences (../, ..%2f, %2e%2e/) in requests targeting the plugin's endpoints (trade-off: may break legitimate file paths that contain encoded dots). On managed hosts, enable Patchstack or an equivalent virtual-patching service for WordPress to receive a vendor-supplied mitigation for this specific CVE.