What is the CVSS score of CVE-2026-65531?

CVE-2026-65531 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Qubely CVE-2026-65531

EUVD-2026-48132 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-xfmg-6jq2-vj2x

WordPress Authentication Bypass Qubely Wordpress Plugin Themeum

4.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Network-exposed unauthenticated endpoint justifies AV:N and PR:N; AC:H reflects non-trivial exploitation path; no availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:10 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

AnalysisAI

Broken access control in the Qubely WordPress Gutenberg block plugin (versions up to and including 1.8.14) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in limited confidentiality and integrity compromise. The vulnerability stems from missing authorization enforcement (CWE-862) on one or more plugin endpoints exposed to the network. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector reflects high attack complexity, tempering real-world risk below what the unauthenticated access vector alone might suggest.

Technical ContextAI

Qubely is a Gutenberg-based WordPress page builder plugin developed by Themeum (CPE: cpe:2.3:a:themeum:qubely:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): the plugin registers AJAX handlers, REST API routes, or admin-facing endpoints that fail to verify the caller's capability or nonce before processing sensitive operations. WordPress plugins commonly expose wp-ajax or REST endpoints that are reachable without authentication; when authorization checks are absent or bypassable, unauthenticated callers can invoke functionality intended only for editors or administrators. The AC:H metric in the CVSS vector indicates that exploitation requires some non-default condition - likely a specific endpoint, parameter, or request sequence - rather than a trivially repeatable attack against any Qubely installation.

RemediationAI

Update the Qubely plugin to a version later than 1.8.14 as soon as a patched release becomes available via the WordPress plugin repository or the Themeum website. No exact fixed version number was confirmed in the provided intelligence - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/qubely/vulnerability/wordpress-qubely-plugin-1-8-14-broken-access-control-vulnerability-2?_s_id=cve should be monitored for patch confirmation. As a compensating control, restrict access to WordPress admin-ajax.php and REST API endpoints at the WAF or web server layer for unauthenticated users where Qubely functionality does not require public-facing access. Alternatively, temporarily deactivating the Qubely plugin eliminates the attack surface entirely, at the cost of losing page-builder functionality on affected posts. Sites behind an authentication gateway (e.g., SSO or HTTP basic auth at the server level) are effectively shielded from unauthenticated exploitation.