What is the CVSS score of CVE-2026-65525?

CVE-2026-65525 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Civi Framework CVE-2026-65525

EUVD-2026-48126 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-c2v9-7ff7-q3p4

WordPress Authentication Bypass Wordpress Plugin Civi Framework Uxper

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication aligns with PR:N; integrity-only low impact reflects unauthorized action without data disclosure or service disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:12 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

AnalysisAI

Broken access control in the Civi Framework WordPress plugin (versions <= 2.2.0) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in unauthorized integrity impact against the host WordPress site. Reported by Patchstack, this is a CWE-862 (Missing Authorization) flaw where protected endpoints fail to validate whether the requesting party has the necessary permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

The Civi Framework plugin (CPE: cpe:2.3:a:uxper:civi_framework:*:*:*:*:*:*:*:*) is developed by uxper and extends WordPress functionality. The root cause is CWE-862 (Missing Authorization), a class of vulnerability where the application fails to implement or enforce authorization checks on one or more actions or endpoints, allowing any caller - including unauthenticated users - to invoke functionality intended to be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is reachable over the network without any credential or privilege, with no special configuration required beyond having the plugin installed and active. The scope is unchanged (S:U), indicating the impact is confined to the vulnerable component itself.

RemediationAI

The primary remediation is to update the Civi Framework WordPress plugin to a version above 2.2.0; however, an exact patched version number is not independently confirmed from the available data - verify the current release in the WordPress plugin repository or via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/civi-framework/vulnerability/wordpress-civi-framework-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve before upgrading. If an update is not yet available or cannot be applied immediately, a compensating control is to deactivate or remove the Civi Framework plugin entirely, which eliminates the attack surface at the cost of losing any functionality the plugin provides. Alternatively, a web application firewall (WAF) rule blocking unauthenticated requests to the plugin's specific restricted endpoints may reduce exposure, but this requires knowledge of the exact affected endpoints - which are not disclosed in the available data - and should be treated as a temporary measure only.