What is the CVSS score of CVE-2026-54833?

CVE-2026-54833 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Enable CORS are affected by CVE-2026-54833?

The WordPress 'Enable CORS' plugin (version 2.0.3 and earlier) contains an unauthenticated backdoor using a hard-coded cryptographic key, enabling remote attackers to bypass access controls and read…

How to fix or mitigate CVE-2026-54833?

24 hours: Identify all WordPress installations with 'Enable CORS' plugin versions 2.0.3 or earlier; uninstall or disable the plugin immediately. 7 days: Conduct forensic audit of database and file modifications; review access logs for suspicious activity since plugin installation; run full security scan of affected systems. 30 days: Deploy alternative CORS solution; if immediate removal is not feasible, implement WAF rules to block exploitation attempts against WordPress admin and API endpoints.

Enable CORS CVE-2026-54833

EUVD-2026-39677 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-06-26 audit@patchstack.com

GHSA-j6v4-3f83-jr3w

WordPress Information Disclosure Wordpress Plugin

7.4

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Remote and unauthenticated (AV:N/PR:N/UI:N), but recovering and applying the hard-coded key adds AC:H; key abuse exposes and alters protected data (C:H/I:H) with no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:35 vuln.today

DescriptionCVE.org

Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

AnalysisAI

Unauthenticated backdoor in the WordPress "Enable CORS" plugin (versions <= 2.0.3) lets remote attackers leverage a hard-coded cryptographic key (CWE-321) to bypass access controls and read or alter protected data without any credentials. Reported by Patchstack and tagged as Information Disclosure, the issue carries a CVSS 7.4; no public exploit and no CISA KEV listing exist at the time of analysis, and despite the network attack vector the CVSS marks high attack complexity, indicating exploitation is non-trivial.

Technical ContextAI

The affected component is the "Enable CORS" WordPress plugin, which exposes Cross-Origin Resource Sharing controls to a WordPress site. The root cause is CWE-321 (Use of a Hard-coded Cryptographic Key): a secret embedded in the plugin code is the same across every installation, so it cannot serve as a true authentication or integrity secret. Because the key is shared and discoverable from the distributed plugin, anyone who recovers it can forge or validate whatever the key protects (tokens, signatures, or privileged endpoints) - functioning as an effective backdoor. The CVSS vector (AV:N/AC:H) indicates the weakness is reachable over the network but requires meeting specific conditions to exploit, consistent with needing to derive and correctly apply the hard-coded key.

RemediationAI

No vendor-released patch version was identified at time of analysis; the input provides no fixed version number, only the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/enable-cors/vulnerability/wordpress-enable-cors-plugin-2-0-3-backdoor-vulnerability?_s_id=cve), which should be consulted for an updated release. Because the flaw is a hard-coded cryptographic key acting as a backdoor, the most reliable compensating control is to deactivate and remove the Enable CORS plugin until a fixed version is confirmed, accepting the trade-off that legitimate cross-origin requests configured through it will stop working. If the plugin must remain active, restrict access to its endpoints at the web server or WAF layer (for example, block or authenticate requests to the plugin's CORS handler paths) and monitor for anomalous cross-origin or unauthenticated requests; this reduces exposure but may break some intended cross-origin functionality. Avoid relying on the plugin's own key-based protection, since the shared key cannot be trusted.