What is the CVSS score of CVE-2026-57377?

CVE-2026-57377 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

WowAddons CVE-2026-57377

Q: Which versions of WowAddons are affected by CVE-2026-57377?

Missing authorization in WPXPO WowAddons WordPress plugin (versions through 1.6.8) enables unauthenticated remote attackers to invoke privileged plugin actions without proper access control checks.

EUVD-2026-43442 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Wowaddons Wpxpo

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible WordPress AJAX endpoint with no authentication gate (AV:N, PR:N, AC:L); impact limited to integrity and availability with no confidentiality exposure supported by description or references.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:28 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through <= 1.6.8.

AnalysisAI

Missing authorization in WPXPO WowAddons WordPress plugin (versions through 1.6.8) enables unauthenticated remote attackers to invoke privileged plugin actions without proper access control checks. Exploitation produces limited integrity and availability impact - unauthorized modification or disruption of plugin-managed content - with no confidentiality exposure confirmed by the CVSS vector. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the zero-privileges-required network vector makes this class of flaw attractive for opportunistic automated scanning once a proof-of-concept surfaces.

Technical ContextAI

WowAddons (WordPress plugin slug: product-addons) is developed by WPXPO and provides product add-on widgets for WordPress e-commerce environments, likely integrating with WooCommerce or Elementor. The root cause is CWE-862 (Missing Authorization): one or more plugin-registered AJAX handlers or REST API endpoints execute privileged logic without verifying that the requesting user holds the required WordPress capability. In WordPress, this commonly manifests as wp_ajax_nopriv_ action handlers - or wp_ajax_ actions callable without a nonce or capability check - that omit calls to current_user_can() before processing sensitive operations. The CPE string cpe:2.3:a:wpxpo:wowaddons:*:*:*:*:*:*:*:* covers all versions through and including 1.6.8, with no platform-specific exclusions indicated.

RemediationAI

Update WowAddons to a version above 1.6.8 once WPXPO releases a patched build; monitor both the WordPress.org plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/product-addons/vulnerability/wordpress-wowaddons-plugin-1-6-8-broken-access-control-vulnerability for confirmation of a fixed release version, as no exact patched version was confirmed in available intelligence at time of analysis. If an immediate upgrade path is unavailable, deactivate the plugin until a patch is applied - this eliminates the attack surface entirely at the cost of losing all WowAddons product add-on functionality. As a compensating control without deactivation, deploy a WordPress-aware WAF with virtual patching (Patchstack Shield, Wordfence, or Cloudflare WordPress rulesets) to block unauthenticated requests to the specific unprotected AJAX or REST endpoints; note this does not remediate the underlying flaw and may require rule updates as attacker techniques evolve. Additionally, restrict access to wp-admin/admin-ajax.php by IP or authentication layer where operationally feasible to limit the attack surface.