What is the CVSS score of CVE-2026-57665?

CVE-2026-57665 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

GravityView CVE-2026-57665

EUVD-2026-39670 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-26 audit@patchstack.com

GHSA-2rwg-7jf4-q7mq

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable IDOR with no authentication required (PR:N) exposing read-only entry data (C:L); no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:07 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

AnalysisAI

Unauthenticated IDOR in GravityView WordPress plugin (≤ 3.0.0) allows remote attackers to bypass object-level authorization and access form entry data belonging to other users without any credentials or interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is trivially reachable over the network with no prerequisites beyond the plugin being active and a view being publicly rendered. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement and low complexity make manual exploitation straightforward.

Technical ContextAI

GravityView is a widely used WordPress plugin that renders Gravity Forms entry data on the frontend via configurable 'Views'. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the plugin uses user-supplied identifiers - such as numeric entry IDs - to reference backend objects without verifying that the requesting party is authorized to access the specific record. An attacker can manipulate these keys in HTTP requests to traverse object references and read arbitrary Gravity Forms entries. Because Gravity Forms is frequently used to collect PII, contact data, and application submissions, the confidentiality exposure can be significant despite the Medium CVSS score. No CPE string was provided in the supplied intelligence; affected scope is defined as GravityView plugin versions up to and including 3.0.0 per EUVD-2026-39670.

RemediationAI

Update GravityView to a version above 3.0.0 via the WordPress plugin dashboard or the WordPress plugin repository. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gravityview/vulnerability/wordpress-gravityview-plugin-3-0-0-insecure-direct-object-references-idor-vulnerability) should be consulted for the confirmed patched release version, as no exact fix version number is present in the available intelligence data - verify the current patched version before deploying. If immediate patching is not feasible, restrict all GravityView-rendered pages to authenticated users only by requiring WordPress login to view those pages; note this will break any intended public-facing GravityView displays. Alternatively, temporarily disable the GravityView plugin until patching is possible, accepting the loss of entry display functionality. Upstream fix availability beyond version 3.0.0 is not independently confirmed from the provided data.