What is the CVSS score of CVE-2026-65452?

CVE-2026-65452 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Ebook Store CVE-2026-65452

Q: Which versions of Ebook Store are affected by CVE-2026-65452?

Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data.

EUVD-2026-48217 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-p23h-q3g8-95q2

WordPress Authentication Bypass Ebook Store Wordpress Plugin Motov Net

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable, no credentials or interaction needed; impact confined to partial data read with no write or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:29 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

AnalysisAI

Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.

Technical ContextAI

The Ebook Store plugin (CPE: cpe:2.3:a:motov.net:ebook_store:*:*:*:*:*:*:*:*, vendor: motov.net) is a WordPress plugin designed for selling and managing digital ebooks. The root cause is CWE-862 (Missing Authorization): one or more of the plugin's WordPress AJAX handlers, REST API routes, or admin-facing actions fail to invoke the appropriate WordPress capability check (e.g., current_user_can()) before processing the request. This is a recurring structural pattern in WordPress plugins where developers implement functionality without gating it behind role or nonce verification, leaving endpoints reachable by unauthenticated HTTP requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no preconditions beyond plugin availability.

RemediationAI

Update the Ebook Store plugin to any release beyond version 6.19 if a patched version has been published by motov.net - no specific fixed version number is confirmed in the available data, so administrators should consult the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-6-19-broken-access-control-vulnerability) for the latest patched release. If no patch is available or deployment cannot be updated immediately, consider temporarily deactivating the plugin to eliminate the attack surface entirely, noting this will disable ebook store functionality. Alternatively, deploy a WordPress application firewall such as Patchstack or Wordfence with a virtual patch targeting the vulnerable endpoints. Server-level access restrictions (e.g., nginx location blocks or Apache mod_rewrite rules) targeting the specific AJAX actions or REST routes involved may reduce exposure but risk breaking legitimate plugin functionality if the exact endpoint identifiers are not known.