What is the CVSS score of CVE-2026-65541?

CVE-2026-65541 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Staff Training are affected by CVE-2026-65541?

The Staff Training WordPress plugin (versions 1.0.7 and earlier) contains a broken access control flaw that exposes protected administrative functions to unauthenticated remote attackers, enabling…

How to fix or mitigate CVE-2026-65541?

Within 24 hours, scan all WordPress installations to identify those running Staff Training plugin v1.0.7 or earlier and document business-critical data handled by the plugin. Within 7 days, remove the plugin from all affected sites or, if replacement is not immediately feasible, disable it and implement Web Application Firewall (WAF) rules to block requests to the plugin's vulnerable endpoints. Within 30 days, migrate to an alternative staff training solution with active security maintenance, conduct vendor security assessments to prevent similar vulnerabilities, and document full remediation completion for compliance and audit purposes.

Staff Training CVE-2026-65541

EUVD-2026-53971 HIGH

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-rfv7-w63w-m4q2

WordPress Authentication Bypass Wordpress Plugin Staff Training

7.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-accessible WordPress endpoint requires no authentication (PR:N per CWE-862 broken access control); partial CIA impact limited to plugin-scoped data with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:30 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.3

DescriptionCVE.org

Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

AnalysisAI

Broken access control in the Staff Training WordPress plugin (versions ≤ 1.0.7, by Solutioned) exposes protected plugin functionality to unauthenticated remote attackers, enabling unauthorized read, write, and limited availability impacts against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - one or more plugin-registered endpoints fail to verify caller capabilities before executing privileged operations. No public exploit code or active exploitation has been confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates extremely low exploitation complexity against any reachable WordPress site running the affected plugin.

Technical ContextAI

The Staff Training plugin (CPE: cpe:2.3:a:solutioned:staff_training:*:*:*:*:*:*:*:*) by Solutioned is a WordPress plugin designed to manage employee training content. CWE-862 (Missing Authorization) indicates that one or more plugin-registered endpoints - likely WordPress admin-ajax.php handlers or REST API routes - fail to invoke current_user_can() or equivalent capability checks before executing privileged operations. WordPress's access control model requires plugins to explicitly gate functionality behind capability checks; when absent, any caller including unauthenticated visitors can invoke the endpoint. This maps to OWASP A01:2021 (Broken Access Control). The CVSS vector's PR:N and UI:N confirm no credential or social-engineering requirement, and S:U indicates the impact is scoped to the plugin's own data and functionality rather than the broader WordPress environment.

RemediationAI

No specific patched version is confirmed in the available data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/staff-training/vulnerability/wordpress-staff-training-plugin-1-0-7-broken-access-control-vulnerability should be checked immediately for an updated release. If no patch is yet available, administrators should deactivate and remove the Staff Training plugin from all WordPress sites as an immediate compensating control; deactivation eliminates the exposed endpoints entirely without side effects to other plugins. As a secondary control where removal is not operationally feasible, restricting access to WordPress admin-ajax.php and REST API endpoints to authenticated sessions only via WAF rules or web server configuration (e.g., Nginx auth_request or Apache Require valid-user directives) reduces unauthenticated exposure, though this may break plugin features that legitimately serve public-facing requests and must be tested before deployment.