What is the CVSS score of CVE-2026-65537?

CVE-2026-65537 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Cyr to Lat Reloaded CVE-2026-65537

EUVD-2026-48138 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-rf26-7hf8-jj9c

WordPress Authentication Bypass Wordpress Plugin Cyr To Lat Reloaded Transliteration Of Links And File Names Themeisle

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress endpoint, low complexity, subscriber authentication required (PR:L), no UI interaction, limited integrity impact only - aligns with provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:09 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Cyr to Lat reloaded - transliteration of links and file names <= 1.3.3 versions.

AnalysisAI

Broken access control in Cyr to Lat Reloaded (WordPress plugin by Themeisle) allows low-privileged authenticated users at the subscriber role to invoke restricted plugin actions on affected WordPress installations running version 1.3.3 and below. The flaw stems from missing authorization checks (CWE-862), permitting subscribers to perform operations intended for higher-privileged users such as editors or administrators. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via standard WordPress HTTP endpoints make it straightforward to abuse given subscriber-level access.

Technical ContextAI

Cyr to Lat Reloaded is a WordPress plugin developed by Themeisle (CPE: cpe:2.3:a:themeisle:cyr_to_lat_reloaded_-_transliteration_of_links_and_file_names:*:*:*:*:*:*:*:*) that transliterates Cyrillic and non-Latin characters in post slugs and uploaded file names to their Latin equivalents. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX handlers fail to verify that the requesting user possesses the capability required for the operation before executing it. In WordPress, the subscriber role is the lowest authenticated role, typically granted automatically upon public user registration. When nonce checks or capability checks (e.g., current_user_can()) are absent or insufficient on plugin hooks, any authenticated subscriber can reach those code paths over the network via WordPress AJAX or REST API endpoints.

RemediationAI

Update the Cyr to Lat Reloaded plugin to a version beyond 1.3.3 as documented in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/cyr-and-lat/vulnerability/wordpress-cyr-to-lat-reloaded-transliteration-of-links-and-file-names-plugin-1-3-3-broken-access-control-vulnerability - an exact patched release version was not independently confirmed from the available data, so administrators should verify the current release in the WordPress plugin repository before updating. As a compensating control where immediate patching is not possible, disabling open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') eliminates the self-service subscriber account creation path that lowers the attacker access bar; note this will prevent new user signups. Additionally, a Web Application Firewall rule blocking unauthorized AJAX requests to the plugin's registered endpoints can reduce exposure, though this requires identifying the specific vulnerable action hooks from the plugin source.