What is the CVSS score of CVE-2026-57750?

CVE-2026-57750 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

ez Form Calculator Premium CVE-2026-57750

EUVD-2026-41306 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-vv3p-3x4h-5p84

WordPress Authentication Bypass Wordpress Plugin Ez Form Calculator Premium

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible WordPress plugin endpoint, no auth required per PR:N; scope unchanged and only limited integrity write impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:30 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

AnalysisAI

Broken access control in ez Form Calculator Premium WordPress plugin (versions up to and including 2.14.1.2) permits unauthenticated remote attackers to perform restricted plugin actions, resulting in unauthorized integrity modifications. Disclosed by Patchstack and classified under CWE-862 (Missing Authorization), the flaw requires no credentials, no user interaction, and no special configuration, lowering the exploitation barrier significantly. No public exploit code and no CISA KEV listing have been identified at the time of analysis, suggesting limited observed exploitation despite the low attack complexity.

Technical ContextAI

The affected product is the ez Form Calculator Premium WordPress plugin by vendor keksdieb (CPE: cpe:2.3:a:keksdieb:ez_form_calculator_premium:*:*:*:*:*:*:*:*), covering all versions through 2.14.1.2. CWE-862 (Missing Authorization) describes a root cause where the software does not perform an authorization check before executing a sensitive operation - in WordPress plugins this typically manifests as AJAX handlers or REST API endpoints registered without nonce verification, capability checks, or role validation, allowing any visitor to invoke actions normally gated to administrators or authenticated users. WordPress's plugin architecture relies on developers explicitly registering access controls; when omitted, unauthenticated HTTP requests can reach privileged functionality directly.

RemediationAI

Update ez Form Calculator Premium to a version beyond 2.14.1.2 once the vendor releases a patched build - no specific fixed version was confirmed in the available data, so site owners should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ez-form-calculator-premium/vulnerability/wordpress-ez-form-calculator-premium-plugin-2-14-1-2-broken-access-control-vulnerability and the plugin's official changelog for a patched release. As an interim compensating control, consider temporarily deactivating the plugin if its form-building functionality is not business-critical, accepting the trade-off of losing form functionality. Alternatively, a WAF rule blocking unauthenticated POST requests to the plugin's known AJAX or REST endpoints can reduce exposure without requiring deactivation, though specific endpoint paths were not confirmed in the available intelligence. No patch version is independently confirmed at time of analysis.