What is the CVSS score of CVE-2026-65543?

CVE-2026-65543 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Vimeo WordPress Plugin are affected by CVE-2026-65543?

The Vimeo WordPress plugin through version 1.2.2 exposes sensitive subscriber data to unauthenticated attackers, creating immediate data breach risk for any WordPress site using this plugin.

How to fix or mitigate CVE-2026-65543?

Within 24 hours, identify all WordPress instances running Vimeo plugin version 1.2.2 or earlier and immediately deactivate the plugin to block exploitation. Within 7 days, review server logs for unauthorized access attempts, conduct forensic analysis to determine if subscriber data was accessed, initiate breach notification procedures if unauthorized access is confirmed, and deploy Web Application Firewall rules to block external requests to Vimeo plugin endpoints. Within 30 days, monitor Patchstack advisory EUVD-2026-53973 and Vimeo security announcements for patch availability; validate any released patch in staging environment before production deployment and plan upgrade to patched version. Until patched, consider deploying alternative video embedding solutions to restore video functionality.

Vimeo WordPress Plugin CVE-2026-65543

EUVD-2026-53973 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-08-06 Patchstack

GHSA-rg77-jv5c-f6x6

WordPress Information Disclosure Wordpress Plugin Vimeo

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible endpoint leaks data without authentication; confidentiality-only impact with no integrity or availability effect aligns with CWE-201 data disclosure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:31 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.5

DescriptionCVE.org

Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

AnalysisAI

Sensitive subscriber data exposure in the Vimeo WordPress plugin (versions 1.2.2 and earlier) allows unauthenticated remote attackers to retrieve confidential subscriber information via network requests. Reported by Patchstack and tracked as EUVD-2026-53973, the flaw is rooted in CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin actively includes protected subscriber data in responses that should not be accessible without authorization. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.

Technical ContextAI

The affected product is the Vimeo plugin for WordPress, identified by CPE cpe:2.3:a:vimeodev:vimeo:*:*:*:*:*:*:*:* for all versions up to and including 1.2.2. CWE-201 describes a class of flaws where a software component transmits sensitive data - such as API tokens, user metadata, access credentials, or subscriber account details - in outbound responses or logged output accessible to parties who should not receive it. In WordPress plugin context, this commonly manifests as REST API endpoints, AJAX handlers, or rendered page output that leaks subscriber-level user fields (email addresses, roles, private metadata) without enforcing proper capability checks. The Vimeo plugin likely manages video embed configurations and possibly stores Vimeo API credentials or user subscription/access data, any of which could constitute the leaked sensitive content.

RemediationAI

The primary remediation is to update the Vimeo WordPress plugin beyond version 1.2.2; however, no exact fixed version number was provided in the available intelligence - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/vimeo/vulnerability/wordpress-vimeo-plugin-1-2-2-sensitive-data-exposure-vulnerability should be consulted to confirm the patched release. If an update is unavailable or cannot be applied immediately, the plugin should be deactivated to eliminate the exposure surface entirely - deactivation will disable Vimeo embeds on the site but removes the risk. As a compensating control, restricting access to WordPress REST API endpoints or AJAX handlers associated with the plugin via WAF rules or authentication enforcement can limit the blast radius, though the specific endpoints are not identified in available data. Any Vimeo API credentials stored by the plugin should be rotated following remediation.