What is the CVSS score of CVE-2026-57335?

CVE-2026-57335 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Ads by WPQuads CVE-2026-57335

EUVD-2026-40106 MEDIUM

Missing Authorization (CWE-862)

2026-06-29 Patchstack

GHSA-g5p9-fm5v-5qqf

WordPress Authentication Bypass Wordpress Plugin Ads By Wpquads

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible WordPress endpoint, low complexity, subscriber auth required (PR:L), integrity-only impact aligning with ad config manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:22 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.

AnalysisAI

Broken access control in the Ads by WPQuads WordPress plugin (versions <= 3.0.3) allows authenticated subscribers to perform privileged administrative actions they are explicitly unauthorized to execute. The flaw, classified under CWE-862 (Missing Authorization), results in high integrity impact with no confidentiality or availability effect, per the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N vector. No active exploitation has been identified in CISA KEV at time of analysis, though the low attack complexity and widely deployed WordPress ecosystem make this a realistic risk for any site with open subscriber registration.

Technical ContextAI

CWE-862 (Missing Authorization) indicates the plugin fails to verify whether the requesting user has sufficient permissions before executing a sensitive operation. WordPress defines a role hierarchy: subscriber is the lowest authenticated role, with no legitimate authority over plugin settings or ad management. The affected component (CPE: cpe:2.3:a:ads_wpquads:ads_by_wpquads:*:*:*:*:*:*:*:*) is the 'Ads by WPQuads' plugin, a WordPress ad management tool. The vulnerability tag 'Authentication Bypass' in combination with 'Subscriber Broken Access Control' suggests that one or more AJAX endpoints or REST API handlers registered by the plugin omit a capability check (e.g., current_user_can()), allowing any logged-in subscriber to reach functionality intended for editors or administrators. The S:U (Unchanged) scope indicates the impact remains within the vulnerable plugin/site context.

RemediationAI

Update the Ads by WPQuads plugin to a version released after 3.0.3 - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/quick-adsense-reloaded/vulnerability/wordpress-ads-by-wpquads-plugin-3-0-3-broken-access-control-vulnerability and the WordPress plugin repository for the patched release. An exact fixed version number was not independently confirmed from the available data; verify via the plugin changelog before deploying. If an immediate upgrade is not feasible, disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts, noting this will affect any legitimate registration workflow. A Web Application Firewall (WAF) rule blocking unauthenticated or subscriber-role access to the plugin's administrative AJAX actions can serve as a temporary compensating control, though precise action names must be obtained from the plugin code to avoid blocking legitimate traffic. Patchstack's virtual patching service (if subscribed) may provide an interim rule.