What is the CVSS score of CVE-2026-57648?

CVE-2026-57648 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Nelio Content CVE-2026-57648

EUVD-2026-39763 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-65vc-5v9h-jmcw

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress plugin requiring Contributor-level authentication (PR:L); missing authorization permits limited integrity modifications only, with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:11 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

AnalysisAI

Broken access control in the Nelio Content WordPress plugin (versions 4.3.4 and earlier) allows authenticated users holding only the Contributor role to bypass intended authorization restrictions and perform actions reserved for higher-privileged roles. The root cause is missing authorization checks (CWE-862) on one or more plugin endpoints, enabling unauthorized integrity-affecting operations on content managed by the plugin. No public exploit code is identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Nelio Content is a WordPress plugin designed for editorial planning, content scheduling, and social media integration. In the WordPress role hierarchy, Contributors can draft posts but cannot publish or manage others' content without explicit promotion. CWE-862 (Missing Authorization) indicates that the plugin fails to verify the calling user's capabilities before executing sensitive operations - a common pattern in WordPress plugin vulnerabilities where nonce verification is present but role/capability checks are absent or insufficient. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the flaw is reachable over the network by any authenticated low-privilege user without special conditions. No CPE string was provided in the source data, but EUVD-2026-39763 confirms the affected range as all Nelio Content versions up to and including 4.3.4.

RemediationAI

Update Nelio Content to a version beyond 4.3.4 as soon as the vendor releases a patched build - no specific fixed version number is confirmed in the available source data, so administrators should monitor the Patchstack advisory and the WordPress plugin repository for an update. As compensating controls prior to patching: audit and reduce the number of accounts granted the Contributor role to only trusted individuals; disable public contributor registration if not operationally required; and consider using a WordPress role management plugin (such as Members or User Role Editor) to further restrict Contributor capabilities within Nelio Content's feature set. Note that role-restriction plugins may interfere with legitimate contributor workflows if Nelio Content features are used by authors. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/nelio-content/vulnerability/wordpress-nelio-content-plugin-4-3-4-broken-access-control-vulnerability should be monitored for patch confirmation.