What is the CVSS score of CVE-2026-66459?

CVE-2026-66459 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

AI for SEO CVE-2026-66459

Q: Which versions of AI for SEO are affected by CVE-2026-66459?

Broken access control in the AI for SEO WordPress plugin (versions ≤ 2.4.2) permits unauthenticated remote attackers to invoke restricted plugin functionality without credentials.

EUVD-2026-57878 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-8646-8444-mw3g

WordPress Authentication Bypass Wordpress Plugin Ai For Seo

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-exploitable with no authentication (PR:N, AV:N) per description and CWE-862; no confidentiality impact (C:N) as access control bypass enables action execution, not data read.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:15 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.

AnalysisAI

Broken access control in the AI for SEO WordPress plugin (versions ≤ 2.4.2) permits unauthenticated remote attackers to invoke restricted plugin functionality without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position - any internet-facing WordPress site running the affected plugin is reachable. Impact is bounded to partial integrity and availability disruption (I:L/A:L) with no confidentiality exposure, suggesting unauthorized manipulation of plugin operations rather than data exfiltration. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

AI for SEO is a WordPress plugin developed by Space Codes (CPE: cpe:2.3:a:space_codes:ai_for_seo:*:*:*:*:*:*:*:*) that provides AI-assisted search engine optimization features. WordPress plugins commonly expose AJAX action handlers or REST API routes; CWE-862 (Missing Authorization) indicates that one or more of these endpoints fails to verify whether the requesting user holds the required WordPress capability before executing privileged operations. In the WordPress security model, this typically means a missing current_user_can() check or absent nonce verification on an action that should be restricted to editors, administrators, or other authenticated roles. Because the flaw is tagged 'Authentication Bypass', the missing check allows completely unauthenticated callers - not just lower-privileged authenticated users - to trigger the protected functionality.

RemediationAI

Update the AI for SEO plugin to the first release beyond version 2.4.2 that addresses this flaw - consult the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ai-for-seo/vulnerability/wordpress-ai-for-seo-plugin-2-4-2-broken-access-control-vulnerability for the exact patched version, as no specific fix version was confirmed in the available input data. If a patched release is not yet available, deactivate the plugin entirely until a fix ships, as plugin deactivation eliminates the exposed endpoints without affecting the WordPress core installation. As a secondary mitigation, a Web Application Firewall (WAF) rule blocking unauthenticated POST requests to the plugin's specific AJAX actions or REST routes can reduce exposure without full deactivation, though this approach requires identifying the exact endpoints from plugin source code. Note that WAF rules may block legitimate functionality if the plugin uses the same endpoints for authorized users.