Civi Framework CVE-2026-65525

No authentication is required - the CVSS vector PR:N/UI:N confirms unauthenticated remote exploitation against any WordPress installation with the Civi Framework plugin active and versions <= 2.2.0 installed. The plugin must be installed and active on the target WordPress site; a deactivated or removed plugin eliminates the attack surface. No non-default configuration is required. The limiting factors are: (1) the attacker must know or discover the specific endpoint(s) lacking authorization checks, as these are not publicly documented at time of analysis; (2) impact is restricted to integrity at a low level - confidential data cannot be read and availability cannot be disrupted via this vulnerability alone. The affected functionality type (what restricted action is accessible) is not detailed in available data, which limits precise risk scoping.

The NVD-assigned CVSS base score of 5.3 (Medium) is consistent with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The network attack vector with no authentication and no complexity represents significant accessibility, but the impact is limited strictly to integrity at a low level - there is no confidentiality exposure and no availability impact. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not present in the CISA KEV catalog, and no publicly available proof-of-concept exploit was identified. In practice, the realistic priority depends on what specific restricted actions can be performed; the absence of confidentiality impact limits the severity but unauthorized writes or state changes in a CMS context can still be disruptive. This is a real but moderate-priority finding - not a critical-response item absent active exploitation evidence, but should be patched promptly given the zero-barrier unauthenticated access.

An unauthenticated attacker discovers a WordPress site running Civi Framework version 2.2.0 or earlier, then crafts HTTP requests directly targeting plugin endpoints that are intended to require authorization. Because no authorization check is enforced (CWE-862), the server processes the request and performs the restricted action - such as modifying plugin data or configuration - without validating the caller's identity. No public proof-of-concept exploit has been identified, but the low attack complexity and zero authentication requirement mean exploitation is straightforward for any attacker who identifies the affected endpoint.