EUVD-2026-43442Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible WordPress AJAX endpoint with no authentication gate (AV:N, PR:N, AC:L); impact limited to integrity and availability with no confidentiality exposure supported by description or references.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through <= 1.6.8.
AnalysisAI
Missing authorization in WPXPO WowAddons WordPress plugin (versions through 1.6.8) enables unauthenticated remote attackers to invoke privileged plugin actions without proper access control checks. Exploitation produces limited integrity and availability impact - unauthorized modification or disruption of plugin-managed content - with no confidentiality exposure confirmed by the CVSS vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required (confirmed by PR:N in the provided CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector), and no special server configuration is needed beyond having the WowAddons plugin installed and active on any WordPress site accessible from the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (Medium) is anchored by an AV:N/AC:L/PR:N/UI:N attack vector - trivially reachable by any unauthenticated internet actor without preconditions - while impact is bounded to I:L and A:L with C:N, preventing elevation to high or critical severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated external attacker enumerates a target WordPress site and confirms the presence of WowAddons 1.6.8 or earlier via standard plugin detection techniques. The attacker then crafts an HTTP POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) with the action parameter corresponding to an unprotected plugin handler, executing a privileged function without supplying credentials. … |
| Remediation | Update WowAddons to a version above 1.6.8 once WPXPO releases a patched build; monitor both the WordPress.org plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/product-addons/vulnerability/wordpress-wowaddons-plugin-1-6-8-broken-access-control-vulnerability for confirmation of a fixed release version, as no exact patched version was confirmed in available intelligence at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today