What is the CVSS score of CVE-2026-57721?

CVE-2026-57721 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

ApplyOnline CVE-2026-57721

EUVD-2026-41092 MEDIUM

Missing Authorization (CWE-862)

2026-07-01 audit@patchstack.com

GHSA-wj2r-v957-gq8q

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no authentication required (PR:N, AV:N); integrity-only impact (I:L) as the bypass enables unauthorized data modification without confidentiality exposure or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:42 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects ApplyOnline: from n/a through 2.6.7.6.

AnalysisAI

Missing authorization controls in the ApplyOnline WordPress plugin (versions through 2.6.7.6) by WP Reloaded allow unauthenticated remote attackers to perform unauthorized write-level actions by exploiting incorrectly configured access control security levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against any network-accessible WordPress installation running this plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirement make this straightforward to abuse.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that the requesting user has permission to perform an operation before executing it. In the WordPress plugin ecosystem, this typically manifests as REST API endpoints, AJAX handlers, or admin-facing actions registered without proper capability checks - allowing any visitor to trigger privileged functionality. The affected product is the ApplyOnline plugin by WP Reloaded, a WordPress job application management tool. The CVSS integrity impact (I:L) with no confidentiality or availability impact suggests the bypass enables unauthorized data modification rather than information disclosure or service disruption. The Patchstack advisory tag 'Authentication Bypass' further indicates that access-gated functionality can be reached without credentials.

RemediationAI

The primary remediation is to update the ApplyOnline plugin beyond version 2.6.7.6. However, no specific patched version number was confirmed in the available data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/apply-online/vulnerability/wordpress-applyonline-plugin-2-6-7-6-broken-access-control-vulnerability should be checked directly for the confirmed fixed release. If a patch is not yet available or cannot be applied immediately, the most effective compensating control is to deactivate the ApplyOnline plugin entirely until a fix is confirmed; deactivation removes the exposed endpoints from the attack surface with no partial-mitigation trade-offs. Alternatively, site administrators can restrict access to WordPress AJAX and REST API endpoints at the web server or WAF layer for unauthenticated users, though this may break legitimate plugin functionality and requires testing. Enabling a WordPress security plugin that enforces capability checks (e.g., Patchstack or Wordfence) can provide virtual patching coverage while awaiting an official fix.