What is the CVSS score of CVE-2026-54847?

CVE-2026-54847 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Stylish Cost Calculator are affected by CVE-2026-54847?

The Stylish Cost Calculator WordPress plugin (versions 8.3.9 and earlier) contains a broken access control vulnerability that enables unauthenticated attackers to bypass authorization controls and…

How to fix or mitigate CVE-2026-54847?

Within 24 hours: Search WordPress plugin inventory and security scanning tools for Stylish Cost Calculator versions 8.3.9 and earlier; identify all affected installations and their exposure. Within 7 days: Disable and remove the plugin from all affected WordPress sites, or implement network-level access controls (IP whitelisting, WAF rules) if immediate removal is not feasible. Within 30 days: Monitor Patchstack advisories and the vendor for a patched release; when available, update all WordPress sites to the fixed version or migrate to an alternative solution.

Stylish Cost Calculator CVE-2026-54847

EUVD-2026-39684 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-7j85-cm6p-6v5x

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with no user interaction yields AV:N/AC:L/PR:N/UI:N; broken access control discloses protected data so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:37 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.

AnalysisAI

Unauthorized data exposure in the Stylish Cost Calculator WordPress plugin (versions 8.3.9 and earlier) lets remote unauthenticated attackers reach functionality that should be access-controlled, exposing sensitive information. Reported through Patchstack and classified as a broken access control / missing authorization flaw (CWE-862), it carries a CVSS 7.5 with confidentiality-only impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Stylish Cost Calculator, a commercial WordPress plugin that builds interactive pricing/quote calculators and forms for websites. The root cause is CWE-862 (Missing Authorization): one or more of the plugin's endpoints - typically exposed via WordPress AJAX actions (admin-ajax.php) or REST routes - fail to verify the caller's capability/permission before returning data or performing an operation. Because WordPress plugins commonly register both privileged and 'nopriv' AJAX handlers, a handler intended for authenticated/administrative use that is also wired to an unauthenticated path (or simply omits a current_user_can()/nonce check) allows any visitor to invoke it. The CVSS confidentiality-only profile (C:H/I:N/A:N) indicates the practical effect is reading data that should be protected rather than modifying state.

RemediationAI

Upgrade the Stylish Cost Calculator plugin to a release newer than 8.3.9; the input identifies 8.3.9 and earlier as vulnerable but does not specify the exact fixed version, so confirm the patched build via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/stylish-cost-calculator/vulnerability/wordpress-stylish-cost-calculator-plugin-8-3-9-broken-access-control-vulnerability?_s_id=cve) and the WordPress plugin changelog before deploying. If an immediate update is not possible, compensating controls include placing the affected AJAX/REST endpoints behind a WAF rule (Patchstack or equivalent virtual patching often ships a rule for this CVE), and restricting or rate-limiting unauthenticated requests to /wp-admin/admin-ajax.php actions associated with the plugin - note this can break legitimate front-end calculator functionality for anonymous visitors. As a last resort, deactivate the plugin until patched, which removes the exposure entirely but disables the pricing-calculator feature. Patch status: released patched version not independently confirmed from the provided data.