What is the CVSS score of CVE-2026-66454?

CVE-2026-66454 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

WP Social Avatar CVE-2026-66454

EUVD-2026-57874 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-h6x8-fqgh-vwfq

WordPress Authentication Bypass Wordpress Plugin Wp Social Avatar

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint (AV:N, PR:N) with straightforward exploitation (AC:L); impact bounded to low integrity and availability within the plugin scope, no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:16 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.

AnalysisAI

Broken access control in WP Social Avatar WordPress plugin (versions ≤ 1.5) exposes one or more plugin endpoints to unauthenticated remote attackers, who can perform restricted operations without valid credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation with no credentials or user interaction required, with consequences limited to low-severity integrity and availability impact and no confidentiality exposure. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

WP Social Avatar is a WordPress plugin developed by Maruti Mohanty (CPE: cpe:2.3:a:maruti_mohanty:wp_social_avatar:*:*:*:*:*:*:*:*) that provides social avatar management functionality within WordPress installations. The root cause is CWE-862 (Missing Authorization): the plugin registers one or more action handlers or REST API routes - commonly via WordPress hooks such as add_action() or register_rest_route() - without attaching an appropriate permission_callback or capability check, leaving those endpoints reachable by any unauthenticated HTTP client. This is a well-documented antipattern in WordPress plugin development and is the same class of flaw that Patchstack routinely identifies across the plugin ecosystem. The unchanged scope (S:U) indicates exploitation is confined to the plugin's own context within WordPress.

RemediationAI

The primary remediation is to update WP Social Avatar to a version beyond 1.5. No exact patched version number is independently confirmed in the available intelligence - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-social-avatar/vulnerability/wordpress-wp-social-avatar-plugin-1-5-broken-access-control-vulnerability should be consulted for the confirmed fix version, and the official WordPress plugin repository should be checked for the latest release. If immediate upgrade is not feasible, deactivating the plugin entirely eliminates exposure at the cost of losing the plugin's social avatar features - a trade-off generally acceptable during a short patching window. As a secondary compensating control, a web application firewall rule blocking unauthenticated requests to the plugin's specific action or REST endpoints can reduce attack surface while the patch is staged, though this requires identifying the exact endpoint names from the plugin source code.