What is the CVSS score of CVE-2026-65554?

CVE-2026-65554 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of AnsPress are affected by CVE-2026-65554?

AnsPress WordPress plugin version 4.4.4 contains a broken access control flaw that allows subscriber-level users to perform high-integrity operations reserved for administrators, creating immediate…

How to fix or mitigate CVE-2026-65554?

Within 24 hours: Audit all current subscriber accounts in WordPress sites running AnsPress 4.4.4 and disable open user registration if not business-critical to eliminate new attacker account creation vectors. Within 7 days: Assess whether AnsPress 4.4.4 is operationally necessary; if not, remove the plugin entirely, or if required, restrict plugin access to Administrator and Editor roles using WordPress capability management. Within 30 days: Implement granular role-based capability restrictions, establish automated monitoring for vendor patch announcements, document all active subscriber accounts for continuous oversight, and implement audit logging on high-risk subscriber actions.

AnsPress CVE-2026-65554

EUVD-2026-53982 HIGH

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-wwxj-5hc7-fvp3

WordPress Authentication Bypass Wordpress Plugin Anspress Question And Answer

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network-accessible WordPress plugin; subscriber auth (PR:L) is the only barrier; no confidentiality impact identified; high integrity from unauthorized write actions; low availability disruption plausible.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:53 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber Broken Access Control in AnsPress - Question and answer 4.4.4 versions.

AnalysisAI

Broken Access Control in the AnsPress WordPress plugin version 4.4.4 allows authenticated subscriber-level users to perform high-integrity write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H) confirms low-privilege network exploitation with no user interaction required, making any WordPress site with open user registration a viable target. No active exploitation has been confirmed (not in CISA KEV), and no public POC is referenced in available data.

Technical ContextAI

AnsPress - Question and Answer is a WordPress plugin (CPE: cpe:2.3:a:lattepress:anspress_-_question_and_answer:*:*:*:*:*:*:*:*) that adds community Q&A functionality to WordPress sites. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify whether the currently authenticated user holds sufficient capabilities before executing privileged actions, such as editing, moderating, or deleting Q&A content. WordPress subscriber is the lowest default role and should have no administrative or content-editing rights beyond basic read access. The flaw allows subscribers to cross those role boundaries via unenforced or absent capability checks in the plugin's request handlers.

RemediationAI

No exact patched version is confirmed in the available data - the CPE wildcard in NVD and the absence of a fix version in EUVD indicate a released patch has not been independently verified at time of analysis. Consult the Patchstack advisory directly for the latest patch status. As an immediate compensating control, disable new user registration on WordPress sites running AnsPress (Settings → General → uncheck 'Anyone can register') to prevent unauthenticated users from obtaining subscriber accounts; note this limits community participation as a side effect. Alternatively, deactivate the AnsPress plugin until a confirmed patched version is available. If neither is acceptable, deploy a Web Application Firewall rule to restrict POST requests to AnsPress-specific endpoints to roles above subscriber. Monitor Patchstack and the WordPress plugin repository for an updated release.