What is the CVSS score of CVE-2026-54844?

CVE-2026-54844 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of CheckView are affected by CVE-2026-54844?

The CheckView Automated Testing WordPress plugin (versions 2.1.0 and earlier) contains an authorization bypass vulnerability that allows remote attackers to modify site data and automation workflows…

How to fix or mitigate CVE-2026-54844?

Within 24 hours: Inventory all WordPress instances running CheckView Automated Testing plugin version 2.1.0 or earlier and assess usage scope and criticality. Within 7 days: Disable the plugin or implement compensating controls-Web Application Firewall rules to restrict endpoint access, additional authentication layers, or IP-based access restrictions to the plugin functionality. Within 30 days: Evaluate permanent remediation options by monitoring vendor security advisories for patch availability or selecting an alternative testing plugin.

CheckView CVE-2026-54844

EUVD-2026-39371 HIGH

Missing Authorization (CWE-862)

2026-06-25 Patchstack

GHSA-mrp6-98pf-fr62

WordPress Authentication Bypass Wordpress Plugin Checkview Automated Testing Checkview

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with no interaction (AV:N/AC:L/PR:N/UI:N); missing authorization enables unauthorized state changes, so I:H while C and A are unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:20 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.

AnalysisAI

Missing authorization in the CheckView Automated Testing WordPress plugin (versions 2.1.0 and earlier) lets remote unauthenticated attackers reach functionality that should be access-controlled, enabling unauthorized modification of site data or test/automation state. The CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N) reflects a network-reachable, no-interaction flaw with high integrity impact but no confidentiality or availability loss. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

CheckView is a WordPress plugin providing automated functional/site testing capabilities, deployed on PHP-based WordPress installations. The CPE cpe:2.3:a:checkview:checkview_automated_testing covers all versions up to and including 2.1.0. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints (typically WordPress AJAX actions or REST routes) execute privileged actions without verifying the caller's capability/role or a valid nonce. Because WordPress plugins frequently register wp_ajax_nopriv_ handlers or unauthenticated REST callbacks, a handler that omits a current_user_can() / capability check exposes its action to any anonymous visitor.

RemediationAI

No specific vendor-released patch version was provided in the input, so the actionable step is to upgrade to the latest CheckView release published after 2.1.0 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/checkview/vulnerability/wordpress-checkview-automated-testing-plugin-2-1-0-broken-access-control-vulnerability) or the WordPress plugin repository - do not rely on an assumed version number. Until a fixed build is verified, compensating controls include deactivating the CheckView plugin if automated testing is not actively in use (side effect: loss of test/monitoring functionality), and restricting access to the plugin's endpoints at the web/WAF layer - for example blocking unauthenticated requests to its admin-ajax actions or REST routes by IP allowlisting the testing service's origin (side effect: legitimate test runs from non-allowlisted sources will fail). A virtual patch / WAF rule from Patchstack, if subscribed, can block the specific request pattern without removing functionality.