What is the CVSS score of CVE-2026-65530?

CVE-2026-65530 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

TemplateSpare CVE-2026-65530

EUVD-2026-48131 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-f6r3-4c8g-25hx

WordPress Authentication Bypass Wordpress Plugin Templatespare

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress endpoint requiring subscriber session (PR:L); no integrity or availability impact; confidentiality limited to plugin-scoped data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:11 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

AnalysisAI

TemplateSpare WordPress plugin versions up to and including 4.2.2 exposes restricted functionality to subscriber-level authenticated users via a Broken Access Control flaw (CWE-862: Missing Authorization). Authenticated users holding the WordPress subscriber role - the lowest privilege tier - can bypass intended authorization gates and read data or invoke actions not intended for their role. No public exploit code and no CISA KEV listing are present at time of analysis, but the low attack complexity and network accessibility make this a realistic threat on sites that permit open registration or have untrusted subscriber accounts.

Technical ContextAI

TemplateSpare is a WordPress plugin that provides starter templates for site building. The affected CPE is cpe:2.3:a:templatespare:templatespare:*:*:*:*:*:*:*:* covering all versions through 4.2.2. CWE-862 (Missing Authorization) identifies the root cause: one or more plugin endpoints or AJAX handlers fail to check whether the calling user actually holds a role authorized to perform the requested action, relying only on the fact that the user is logged in (subscriber). In WordPress, subscribers are standard authenticated users with minimal capability - they can read public content but should have no administrative access. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the flaw is network-reachable, requires no special conditions beyond a subscriber session, and results in limited confidentiality exposure with no integrity or availability impact.

RemediationAI

Update the TemplateSpare plugin to a version released after 4.2.2 as soon as one is available from the WordPress plugin repository. Patch availability per vendor advisory is referenced at https://patchstack.com/database/wordpress/plugin/templatespare/vulnerability/wordpress-templatespare-plugin-4-2-2-broken-access-control-vulnerability; however, an exact patched release version is not independently confirmed from the data provided. As an interim compensating control, administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts needed to exploit this flaw - note this may disrupt legitimate registration workflows. Additionally, reviewing and auditing any existing subscriber-level accounts for untrusted users is advisable. Sites using a Web Application Firewall with WordPress-aware rules may be able to block the specific unauthorized requests.