What is the CVSS score of CVE-2026-59528?

CVE-2026-59528 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Shiptime CVE-2026-59528

Q: Which versions of Shiptime are affected by CVE-2026-59528?

Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information.

EUVD-2026-49204 HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-27 Patchstack

GHSA-xqrf-qjxp-m22w

WordPress Information Disclosure Shiptime Wordpress Plugin

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:00 vuln.today

CVE Published

Jul 27, 2026 - 13:59 cve.org

HIGH 7.5

DescriptionCVE.org

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.

AnalysisAI

Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.