What is the CVSS score of CVE-2026-65484?

CVE-2026-65484 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Style Kits CVE-2026-65484

EUVD-2026-48095 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-f79c-j6v2-hjch

WordPress Authentication Bypass Style Kits Wordpress Plugin Analogwp

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Contributor-level authentication required (PR:L) limits external exposure; partial C/I/A impact reflects bounded access control bypass without full site compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:21 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

AnalysisAI

Broken Access Control in the Style Kits WordPress plugin (versions <= 2.6.5) permits authenticated users holding Contributor-level roles to execute privileged actions without proper authorization checks, as classified under CWE-862 (Missing Authorization). Reported by Patchstack and tracked as EUVD-2026-48095, the flaw is remotely exploitable with low attack complexity and no user interaction, exposing partial confidentiality, integrity, and availability of affected WordPress installations. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Style Kits is a WordPress plugin by AnalogWP (CPE: cpe:2.3:a:analogwp:style_kits) that provides design style kit management, commonly used alongside Elementor for visual theming. The root cause is CWE-862 (Missing Authorization) - the plugin fails to enforce capability checks before executing one or more privileged operations, allowing users below the intended privilege threshold to invoke restricted functionality. In the WordPress permission model, Contributors can draft content but cannot publish or manage site configuration; the missing authorization gate collapses that boundary. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms the attack surface is fully remote, requires no special conditions or user interaction, and operates entirely within the plugin's own scope without lateral pivot to the broader WordPress host.

RemediationAI

Update the Style Kits plugin to the first version released after 2.6.5 - the exact patched version number is not confirmed in the available input data and must be verified via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/analogwp-templates/vulnerability/wordpress-style-kits-plugin-2-6-5-broken-access-control-vulnerability before deploying. As an immediate compensating control, audit and restrict Contributor-role assignments on the affected WordPress site, particularly disabling open user registration if it grants Contributor access, which eliminates the primary exploitation path without disabling the plugin. Deactivating the Style Kits plugin entirely is an effective short-term mitigation at the cost of losing style kit functionality until a patched version is confirmed and deployed.