What is the CVSS score of CVE-2026-65485?

CVE-2026-65485 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Content Control CVE-2026-65485

EUVD-2026-48096 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-xrwh-gqrf-25m8

WordPress Authentication Bypass Wordpress Plugin Content Control

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Plugin is network-accessible with no authentication or user interaction required; impact is limited to partial confidentiality with no integrity or availability effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:21 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

AnalysisAI

Unauthenticated broken access control in the Content Control WordPress plugin (versions ≤ 2.6.5) allows remote attackers to bypass content restriction rules and retrieve content intended to be hidden from public or lower-privileged users. The plugin, which provides role-based content gating for WordPress sites, fails to enforce authorization in at least one code path, permitting network access without credentials or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality loss with no integrity or availability effects.

Technical ContextAI

Content Control (CPE: cpe:2.3:a:daniel_iser:content_control:*:*:*:*:*:*:*:*) is a WordPress plugin by Daniel Iser that allows site administrators to restrict posts, pages, and custom content types based on user roles and authentication status. The root cause is CWE-862 (Missing Authorization): the plugin fails to perform adequate entitlement checks before serving gated content in at least one request handler. In WordPress plugins this flaw class typically manifests when REST API routes or AJAX hooks registered with 'wp_ajax_nopriv_' omit a secondary capability or nonce check, or when shortcode and block rendering logic does not verify the current user's right to view protected content before outputting it. The result is that the plugin's restriction rules can be circumvented without any account or session.

RemediationAI

Update the Content Control plugin to a version above 2.6.5 as the primary remediation step. The exact patched release version is not confirmed in the provided data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/content-control/vulnerability/wordpress-content-control-plugin-2-6-5-broken-access-control-vulnerability or the official WordPress plugin repository for the confirmed fixed version before upgrading. If an immediate update is not feasible, temporarily deactivating the plugin removes the vulnerable code path entirely, though doing so will dissolve all configured content restriction rules and may expose previously gated content to all visitors - assess which pages are affected before deactivating. Alternatively, server-level access controls (e.g., restricting specific WordPress REST API namespaces or AJAX endpoints via .htaccess or nginx location blocks) may reduce exposure for specific attack surfaces without full plugin deactivation, but this approach requires identifying the exact vulnerable endpoint and carries a risk of incomplete coverage.