What is the CVSS score of CVE-2026-57661?

CVE-2026-57661 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

WPComplete CVE-2026-57661

Q: Which versions of WPComplete are affected by CVE-2026-57661?

Broken access control in WPComplete WordPress plugin versions up to and including 2.9.5.5 allows authenticated subscribers to perform actions reserved for higher-privileged roles.

EUVD-2026-39666 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-cf3c-69c8-pp4q

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber authentication required (PR:L); network-accessible with no complexity; no confidentiality impact per described access control bypass scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:08 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.

AnalysisAI

Broken access control in WPComplete WordPress plugin versions up to and including 2.9.5.5 allows authenticated subscribers to perform actions reserved for higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privileged WordPress users to bypass access restrictions on plugin functionality. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit by any subscriber-level account.

Technical ContextAI

WPComplete is a WordPress plugin designed to track course and content completion for membership or online course sites. CWE-862 (Missing Authorization) indicates the plugin fails to verify whether the authenticated user has sufficient permissions before executing sensitive actions - a common pattern in WordPress plugins where capability checks (current_user_can()) are omitted from AJAX handlers or REST API endpoints. The CVSS vector confirms network reachability (AV:N), low complexity (AC:L), and low-privilege access (PR:L), consistent with a subscriber-level WordPress user exploiting an unguarded endpoint. Affected CPE covers WPComplete versions n/a through 2.9.5.5 as reported via Patchstack and EUVD-2026-39666.

RemediationAI

No vendor-released patch version is identified at time of analysis based on available data - the EUVD affected version field lists no fixed release. Administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-5-broken-access-control-vulnerability and the WordPress plugin repository for an updated release. As a compensating control, disable open user registration on sites where it is not required (Settings > General > uncheck 'Anyone can register'), which eliminates the subscriber-level attack surface entirely for public exploitation. If subscriber registration is business-critical, consider restricting subscriber accounts to trusted users only and auditing plugin AJAX/REST endpoints for missing capability checks. Applying a WordPress application firewall (e.g., Patchstack, Wordfence) with a virtual patch for this CVE is a lower-disruption interim mitigation.