What is the CVSS score of CVE-2026-66455?

CVE-2026-66455 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

ReactPress CVE-2026-66455

EUVD-2026-57875 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-h8rh-5pc8-x2wc

WordPress Authentication Bypass Wordpress Plugin Reactpress

6.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.0 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

7.4 HIGH

Broken access control via a direct HTTP call is typically low-complexity once the endpoint is known; PR:L confirmed by subscriber requirement; S:C retained as impact extends to broader WordPress site resources.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:16 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

AnalysisAI

Broken access control in the ReactPress WordPress plugin (versions up to and including 3.4.0) permits subscriber-level authenticated users to perform privileged operations that should be restricted to higher-capability roles. The CVSS vector (S:C) indicates the flaw's impact extends beyond the plugin's own trust boundary, potentially affecting broader WordPress site resources such as content or configuration. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

ReactPress is a WordPress plugin developed by Rockiger (CPE: cpe:2.3:a:rockiger:reactpress:*:*:*:*:*:*:*:*) that allows embedding React-powered single-page applications within WordPress pages. CWE-862 (Missing Authorization) indicates the plugin fails to enforce WordPress capability checks - typically via current_user_can() - before executing sensitive operations on one or more REST API or admin-ajax endpoints. This is a pervasive class of flaw in WordPress plugins where developers implement functionality without gating it behind proper role verification. The CVSS S:C (scope changed) metric signals that successful exploitation can affect components outside the plugin's direct trust domain, consistent with a subscriber manipulating site-wide content, settings, or other plugins' data.

RemediationAI

Administrators should update the ReactPress plugin to a version beyond 3.4.0 if a patched release has been published by Rockiger. No exact fixed version number is confirmed in the available intelligence - check the WordPress.org plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/reactpress/vulnerability/wordpress-reactpress-plugin-3-4-0-broken-access-control-vulnerability for the latest patched release. As an interim compensating control, deactivate the ReactPress plugin entirely via the WordPress admin panel (Plugins → Deactivate) if React-powered pages are not actively in use; this eliminates the attack surface with no side effects beyond loss of React page functionality. If the plugin must remain active, restrict WordPress user registration to prevent untrusted parties from obtaining subscriber accounts by navigating to Settings → General and unchecking 'Anyone can register' - this prevents unauthenticated visitors from self-provisioning the required credential. Patchstack subscribers may also benefit from virtual patching coverage for this specific vulnerability.