What is the CVSS score of CVE-2026-65553?

CVE-2026-65553 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Spider Analyser are affected by CVE-2026-65553?

The Spider Analyser WordPress plugin (versions ≤2.1.3) contains a critical unauthenticated remote code execution vulnerability allowing attackers to execute arbitrary PHP code and gain complete…

How to fix or mitigate CVE-2026-65553?

Within 24 hours, audit all WordPress installations for Spider Analyser plugin versions 2.1.3 and earlier and disable or remove the plugin immediately as an emergency containment measure. Over the next 7 days, implement Web Application Firewall (WAF) rules to block payloads targeting plugin endpoints, restrict WordPress administrative access via IP allowlisting, enable server-level monitoring for suspicious PHP execution and file modifications, and establish daily monitoring of wbolt.com for security advisories and patch releases. Within 30 days, evaluate any patched releases from wbolt.com for Spider Analyser, validate thoroughly in staging environments, and plan deployment to production once a vendor patch is confirmed available.

Spider Analyser CVE-2026-65553

EUVD-2026-53981 CRITICAL

Code Injection (CWE-94)

2026-08-06 Patchstack

GHSA-hq89-64jw-675j

WordPress RCE Code Injection Wordpress Plugin Spider Analyser 8211 Wordpress Wbolt Com

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network code injection with no interaction (AV:N/AC:L/PR:N/UI:N); code execution escapes plugin into the host PHP/OS context, giving scope change and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:53 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.

AnalysisAI

Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.

Technical ContextAI

Spider Analyser is a WordPress plugin from Chinese vendor wbolt.com marketed for analysing search-engine crawler (spider) activity against a site. The vulnerability is classified CWE-94 (Improper Control of Generation of Code, i.e. code injection), meaning attacker-controlled input is passed into a PHP execution sink (such as eval, dynamic include/require, or a callable) without sufficient validation. The CPE cpe:2.3:a:wbolt.com:spider_analyser_–_wordpress搜索引擎蜘蛛分析插件:*:*:*:*:*:*:*:* identifies the specific plugin, and any WordPress instance running it inherits the flaw because the injected code executes within the PHP context of the WordPress host.

RemediationAI

No specific fixed version was provided in the available data, so no vendor-released patch is independently confirmed at time of analysis; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/spider-analyser/vulnerability/wordpress-spider-analyser-wordpress-plugin-2-1-3-remote-code-execution-rce-vulnerability) and the wbolt.com plugin page for any release newer than 2.1.3 and upgrade immediately once available. Until a patched build is confirmed, the safest compensating control is to deactivate and remove the Spider Analyser plugin entirely, which fully eliminates the vulnerable code path at the cost of losing spider-analytics functionality. If removal is not acceptable, restrict access to the plugin's endpoints via a WAF rule or web-server ACL and place a virtual patch (Patchstack or equivalent) in front of the site, accepting that WAF filtering is a best-effort mitigation that may be bypassed and does not remove the underlying flaw.