What is the CVSS score of CVE-2026-54832?

CVE-2026-54832 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gutenverse Companion are affected by CVE-2026-54832?

The Gutenverse Companion WordPress plugin (versions 2.5.0 and earlier) allows unauthenticated remote attackers to modify website content due to missing authorization checks, with no public exploit…

How to fix or mitigate CVE-2026-54832?

24 hours: Identify all WordPress installations running Gutenverse Companion versions 2.5.0 or earlier; disable and remove the plugin; audit content modification logs for unauthorized changes. 7 days: Implement Web Application Firewall rules blocking unauthorized HTTP requests to WordPress content modification endpoints; enforce multi-factor authentication on all WordPress administrative accounts and restrict admin access via IP whitelisting. 30 days: Monitor vendor advisories for Gutenverse Companion security patch release; upon availability, test patch in staging environment and deploy to production systems.

Gutenverse Companion CVE-2026-54832

EUVD-2026-39676 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-5fm5-5j35-734h

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Missing authorization on a network-reachable WordPress endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is data modification only, so I:H with C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:35 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.

AnalysisAI

Unauthorized data modification in the Gutenverse Companion WordPress plugin (versions 2.5.0 and earlier) lets remote unauthenticated attackers invoke protected functionality due to a missing authorization check. The CVSS 3.1 vector (AV:N/PR:N/UI:N, I:H, C:N, A:N) indicates a network-reachable, no-login integrity compromise rather than data theft or outage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Gutenverse Companion is an add-on plugin for the Gutenverse block ecosystem on WordPress, typically extending the Gutenberg block editor with templates and companion features. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints - commonly WordPress AJAX actions or REST routes - execute privileged operations without verifying the caller's capability or nonce. Because WordPress exposes admin-ajax.php and the REST API to anonymous requests by default, a 'Broken Access Control' / 'Authentication Bypass' flaw of this class means the access-control gate that should restrict an action to authorized roles is simply absent, allowing any visitor to reach it. The affected-version scope (<= 2.5.0) and the Patchstack source point to a plugin-level authorization defect rather than a WordPress core issue.

RemediationAI

No vendor-released patch version is identified in the available data, so confirm the fixed release directly from the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gutenverse-companion/vulnerability/wordpress-gutenverse-companion-plugin-2-5-0-broken-access-control-vulnerability?_s_id=cve) and upgrade to the first version published above 2.5.0 once available; do not assume a specific number. As compensating controls until a verified patch is applied, restrict access to the plugin's AJAX/REST endpoints at the WAF or web-server layer (for example block or require authentication on the plugin's admin-ajax.php actions and its REST namespace), or virtually patch via a WordPress security plugin or Patchstack mitigation rule; the trade-off is that overly broad rules on admin-ajax.php can break legitimate front-end functionality, so scope rules to the specific vulnerable action. If the companion functionality is non-essential, deactivate and remove the plugin, accepting the loss of its features as the cleanest mitigation.