What is the CVSS score of CVE-2026-59543?

CVE-2026-59543 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Advanced Views are affected by CVE-2026-59543?

The Advanced Views WordPress plugin (by wplake, versions ≤3.8.11) contains a critical remote code execution vulnerability allowing low-privilege Subscriber-level accounts to execute arbitrary code…

How to fix or mitigate CVE-2026-59543?

Within 24 hours: Identify all WordPress installations running Advanced Views plugin version 3.8.11 or earlier and immediately disable or remove the plugin; audit active Subscriber accounts and restrict new Subscriber self-registration if operationally feasible. Within 7 days: Review server access logs, file modification logs, and process activity for signs of unauthorized code execution or exploitation during the vulnerability window; investigate any suspicious indicators. Within 30 days: Monitor Patchstack and the Advanced Views plugin repository for vendor patch availability; once a patch is released, test it thoroughly in a staging environment before deploying to production systems.

Advanced Views CVE-2026-59543

EUVD-2026-48196 CRITICAL

Code Injection (CWE-94)

2026-07-23 Patchstack

GHSA-3c5c-f662-3j96

WordPress RCE Code Injection Wordpress Plugin Advanced Views

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable, low-complexity code injection needing only Subscriber auth (PR:L) and no interaction; arbitrary PHP execution crosses the plugin's scope into the host (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:44 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.9

DescriptionCVE.org

Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

AnalysisAI

Remote code execution in the WordPress "Advanced Views" plugin (by wplake) affects all versions up to and including 3.8.11, allowing an authenticated user with only Subscriber-level privileges to inject and execute arbitrary code (CWE-94) on the server. Rated CVSS 9.9 by Patchstack because a low-privilege account - trivially self-registered on many WordPress sites - can achieve full compromise with no user interaction. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Advanced Views is a WordPress plugin (CPE cpe:2.3:a:wplake:advanced_views) used to build and render custom data views, templates, and dynamic content for Advanced Custom Fields and other data sources, typically via shortcodes and template rendering. CWE-94 (Improper Control of Generation of Code / Code Injection) indicates the plugin evaluates or renders attacker-influenced input as executable PHP or template code rather than treating it as inert data. Because WordPress plugins execute in the context of the PHP interpreter and web-server user, code injection here escalates directly to arbitrary PHP execution within the WordPress runtime and underlying host environment.

RemediationAI

Upgrade the Advanced Views plugin to the fixed release published after 3.8.11 (per the Patchstack advisory the fix follows the 3.8.11 branch; the exact patched version should be confirmed from the wplake changelog / WordPress.org plugin page before deployment - no version number is invented here). Consult the vendor advisory at https://patchstack.com/database/wordpress/plugin/acf-views/vulnerability/wordpress-advanced-views-plugin-3-8-11-remote-code-execution-rce-vulnerability for confirmation. Until patched, the most effective compensating control is to disable open user self-registration (Settings → General → uncheck "Anyone can register"), which removes the Subscriber-account foothold this vulnerability depends on - the trade-off is loss of self-service account creation. Additionally, deactivate the Advanced Views plugin if it is non-essential (trade-off: any pages relying on its views/shortcodes will break), audit existing low-privilege accounts for unexpected registrations, and place the site behind a WAF with virtual-patching rules for the plugin as an interim layer.