What is the CVSS score of CVE-2026-66452?

CVE-2026-66452 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Legal Text Connector CVE-2026-66452

EUVD-2026-53885 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-35mh-jj82-w9jm

WordPress Authentication Bypass Wordpress Plugin It Recht Kanzlei Legal Text Connector Of The It Recht Kanzlei

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint with no interaction needed; impact limited to low integrity and availability with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:13 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.

AnalysisAI

Broken access control in the IT-Recht Kanzlei Legal Text Connector WordPress plugin (versions <= 1.0.13) allows unauthenticated remote attackers to perform unauthorized actions against the plugin's endpoints, resulting in low-severity integrity and availability impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify that a requestor has permission before executing sensitive operations. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is the 'Legal Text Connector of the IT-Recht Kanzlei' WordPress plugin (CPE: cpe:2.3:a:it-recht_kanzlei:legal_text_connector_of_the_it-recht_kanzlei:*:*:*:*:*:*:*:*), which is used primarily by DACH-region e-commerce sites to automatically synchronize legally compliant text content (e.g., terms and conditions, privacy policies) from the IT-Recht Kanzlei legal service. CWE-862 (Missing Authorization) indicates the plugin registers WordPress hooks, REST API routes, or admin-ajax actions without enforcing capability checks, allowing any HTTP client - including unauthenticated visitors - to invoke functionality intended for authenticated operators. This class of flaw is endemic to WordPress plugins that rely on security-by-obscurity for endpoint protection rather than WordPress nonce or capability verification.

RemediationAI

Update the Legal Text Connector of the IT-Recht Kanzlei plugin to a version higher than 1.0.13 - a patched release version was not explicitly confirmed in the available input data, so administrators should check the WordPress plugin repository or the Patchstack advisory at the reference URL for the current fixed release before updating. If an update is not yet available, a compensating control is to restrict access to the plugin's registered WordPress endpoints at the web server or WAF layer - specifically, block unauthenticated POST or GET requests to any admin-ajax.php actions or REST API routes registered by this plugin. Note that blocking admin-ajax.php broadly may disrupt legitimate front-end plugin functionality. Alternatively, temporarily deactivating the plugin eliminates the attack surface entirely while a patch is awaited, at the cost of disabling automatic legal text synchronization.