What is the CVSS score of CVE-2026-65453?

CVE-2026-65453 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Ebook Store CVE-2026-65453

Q: Which versions of Ebook Store are affected by CVE-2026-65453?

Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862).

EUVD-2026-48218 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-fvp7-9cw9-7x5f

WordPress Authentication Bypass Ebook Store Wordpress Plugin Motov Net

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no authentication required (PR:N) per broken access control; scope unchanged (S:U) and impact limited to integrity modification (I:L) with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:29 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

AnalysisAI

Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) denotes that the plugin registers one or more WordPress actions or REST endpoints without verifying whether the requesting user holds the necessary capability before executing the associated logic. The affected product is the Ebook Store plugin by motov.net (CPE: cpe:2.3:a:motov.net:ebook_store:*:*:*:*:*:*:*:*), a WordPress e-commerce plugin designed to sell digital ebook content. In the WordPress ecosystem, broken access control vulnerabilities of this class typically arise when plugin developers register AJAX handlers via wp_ajax_nopriv_ hooks - which execute for unauthenticated users - or omit current_user_can() capability checks before performing privileged operations. The I:L and C:N/A:N impact profile suggests the exploitable action modifies or writes data rather than disclosing it.

RemediationAI

Update the Ebook Store WordPress plugin to a version beyond 6.19 once the vendor releases a patched build; no exact fix version is confirmed in the available data and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-6-19-broken-access-control-vulnerability-2 should be monitored for a confirmed patch release. As an immediate compensating control, administrators should consider temporarily deactivating the plugin until a patch is available - this eliminates exposure completely but disables all ebook store functionality for site visitors. Alternatively, a Web Application Firewall rule can be configured to block unauthenticated POST requests to plugin-specific admin-ajax.php actions or REST endpoints registered by ebook-store, though this requires identifying the specific endpoint name from code review and may cause false positives if the WAF rule is too broad. Restricting wp-admin/admin-ajax.php access to authenticated sessions at the server level is not viable for this class of flaw if the plugin legitimately serves unauthenticated users.