What is the CVSS score of CVE-2026-57782?

CVE-2026-57782 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Universal Clocks CVE-2026-57782

EUVD-2026-43400 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Universal Clocks Presstigers

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable WordPress endpoint requires no authentication; impact is limited to low-severity integrity modification with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:19 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.

AnalysisAI

Universal Clocks WordPress plugin (≤1.2.0) by PressTigers exposes unauthorized action endpoints due to missing authorization checks, enabling unauthenticated remote attackers to perform integrity-impacting operations without valid credentials. Reported by Patchstack under CWE-862, the flaw stems from incorrectly configured access control security levels that fail to validate caller permissions before executing plugin functionality. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) describes a class of flaws where software does not perform an authorization check before executing a sensitive operation. In the context of WordPress plugins, this typically manifests as AJAX handlers or REST API endpoints registered without capability checks (e.g., missing current_user_can() gates or nonce verification tied to a role). The affected product is identified via CPE cpe:2.3:a:presstigers:universal_clocks:*:*:*:*:*:*:*:*, covering all versions through 1.2.0. The plugin is developed by PressTigers and provides clock widget functionality for WordPress sites. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that the vulnerable endpoint is reachable over the network without authentication.

RemediationAI

The primary remediation is to update the Universal Clocks plugin beyond version 1.2.0; however, no specific patched release version has been confirmed in the available intelligence - administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/universal-clocks/vulnerability/wordpress-universal-clocks-plugin-1-2-0-broken-access-control-vulnerability for the latest release. If an update is not yet available, a compensating control is to deactivate and remove the plugin entirely until a patched version is published, which eliminates the attack surface with no functional side effects for non-clock-dependent sites. Alternatively, a WAF rule blocking unauthenticated POST requests to the plugin's AJAX or REST endpoints can reduce exposure, though the exact endpoint paths are not confirmed in available data and this approach requires validation to avoid false positives.