What is the CVSS score of CVE-2026-57781?

CVE-2026-57781 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

MeetingHub CVE-2026-57781

EUVD-2026-43399 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Meetinghub

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication per CWE-862 bypass; scope unchanged and impact limited to low integrity writes with no data disclosure or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:19 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.

AnalysisAI

Missing authorization in the MeetingHub WordPress plugin (versions through 1.25.10) allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized integrity-affecting actions. The CVSS vector (PR:N/AV:N/AC:L/UI:N) confirms no authentication or user interaction is required, making any WordPress installation running an affected version directly exposed from the network. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis.

Technical ContextAI

MeetingHub (CPE: cpe:2.3:a:sovlix:meetinghub:*:*:*:*:*:*:*:*) is a WordPress scheduling/meeting plugin developed by Sovlix. The root cause is CWE-862 (Missing Authorization): one or more plugin action handlers - typically WordPress AJAX hooks or REST API endpoints - fail to verify that the requesting user holds the appropriate capability before executing privileged operations. WordPress best practice requires capability checks via current_user_can() or similar guards on every server-side action. Without these guards, the access control boundary collapses and unauthenticated HTTP requests can trigger plugin-controlled write operations. This class of flaw is categorized under OWASP A01:2021 (Broken Access Control) and is the most frequently reported class of WordPress plugin vulnerability tracked by Patchstack.

RemediationAI

Update the MeetingHub plugin to a version beyond 1.25.10 via the WordPress plugin dashboard or wp-cli (wp plugin update meetinghub). An exact confirmed patched version number is not stated in the available data - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/meetinghub/vulnerability/wordpress-meetinghub-plugin-1-25-10-broken-access-control-vulnerability and the WordPress.org plugin page for the current release. If an update is not immediately available or deployable, consider temporarily deactivating the plugin to eliminate the attack surface entirely (trade-off: loss of meeting scheduling functionality). Alternatively, a Web Application Firewall rule blocking unauthenticated POST requests to the plugin's specific AJAX action or REST endpoint identified in the Patchstack report can serve as a compensating control, though this requires knowing the exact action name from the advisory detail.