What is the CVSS score of CVE-2026-65479?

CVE-2026-65479 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Reviewer Plugin CVE-2026-65479

EUVD-2026-48090 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-h8wh-rjm5-g7rj

WordPress Authentication Bypass Wordpress Plugin Reviewer

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber-level authentication required (PR:L); no confidentiality impact; limited integrity and availability disruption from unauthorized action on plugin content.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:22 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

AnalysisAI

Broken access control in the Reviewer WordPress plugin (versions ≤ 3.14.2) allows subscriber-level authenticated users to perform actions beyond their intended authorization scope, resulting in limited integrity and availability impact on affected installations. Reported by Patchstack and tracked under EUVD-2026-48090, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that a requesting user is permitted to access a resource or perform an action before executing it. In WordPress, the subscriber role is the lowest authenticated user tier and is typically granted to registered site visitors with no administrative capabilities. The Reviewer plugin by MVP Themes (CPE: cpe:2.3:a:mvp_themes:reviewer:*:*:*:*:*:*:*:*) processes requests without adequately enforcing role-based access controls on certain operations, allowing subscriber-level users to cross authorization boundaries. The CVSS vector AV:N/AC:L/PR:L reflects that the flaw is remotely exploitable over HTTP with low attack complexity once any subscriber credential is obtained.

RemediationAI

Update the Reviewer plugin to a version beyond 3.14.2 as the primary remediation; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/reviewer/vulnerability/wordpress-reviewer-plugin-3-14-2-broken-access-control-vulnerability should be consulted for the confirmed patched release version, which is not explicitly stated in the available input data. As a compensating control if immediate patching is not possible, disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent unauthenticated parties from obtaining subscriber accounts, thereby removing external access to the vulnerable functionality. Note that disabling registration may impact legitimate site workflows. Additionally, consider restricting access to the WordPress admin and AJAX endpoints via IP allowlisting at the web server or WAF layer for environments where subscriber-level access is not required from untrusted networks.