What is the CVSS score of CVE-2026-65445?

CVE-2026-65445 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

Ad Invalid Click Protector CVE-2026-65445

EUVD-2026-49658 MEDIUM

Missing Authorization (CWE-862)

2026-07-27 audit@patchstack.com

GHSA-m5m5-596x-7xrf

Authentication Bypass

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Unauthenticated network access and low attack complexity; missing authorization allows minor data modification and availability disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 23:33 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.

AnalysisAI

Broken access control in the Ad Invalid Click Protector (AICP) WordPress plugin up to version 1.3.0 allows unauthenticated attackers to manipulate plugin settings or disrupt its click-protection functionality. No active exploitation or public proof-of-concept is currently known, but the vulnerability is easily triggered over the network with no user interaction.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send crafted HTTP request to unauthenticated plugin endpoint

Exploit

Bypass missing authorization check

Execution

Modify plugin configuration or trigger repeated action

Impact

Disable ad click auditing or degrade service

Access

Send crafted HTTP request to unauthenticated plugin endpoint

Exploit

Bypass missing authorization check

Execution

Modify plugin configuration or trigger repeated action

Impact

Disable ad click auditing or degrade service

Vulnerability AssessmentAI

Exploitation	The AICP plugin must be installed and activated on the WordPress site, and its vulnerable endpoints must be reachable from the internet (AV:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS v3.1 rates this as Medium (6.5): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a crafted HTTP request to a public-facing plugin endpoint (e.g., a wp_ajax_ action) that performs a settings change or triggers a resource-consuming operation. Because authorization checks are missing, the action is processed without authentication, allowing the attacker to disable detection thresholds or repeatedly trigger actions that degrade service availability.
Remediation	No specific patched version has been confirmed at the time of this analysis; check the vendor’s Patchstack page for updates. … Detailed patch versions, workarounds, and compensating controls in full report.