WPComplete CVE-2026-66599

Exploitation requires that the target WordPress site has the WPComplete plugin installed and active in a version at or below 2.9.5.6. The unauthenticated attack vector (PR:N) means no WordPress account is needed by the attacker to submit the malicious payload. User interaction is required (UI:R): a second party - most impactfully a WordPress administrator - must visit or load the page containing the stored payload, or be socially engineered into clicking a crafted URL for reflected variants. The scope change (S:C) is only realized if the interacting user holds elevated WordPress privileges; if only low-privileged subscribers trigger the payload, the practical impact is reduced. Limiting conditions include: the victim must have an active authenticated session at the time of trigger; sites where untrusted users cannot reach WPComplete input surfaces (e.g., members-only or admin-only deployment) have a reduced attack surface.

The CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a remotely exploitable, low-complexity flaw requiring no authentication, but dependent on a privileged user interacting with attacker-controlled content (UI:R). The scope change (S:C) is the most consequential dimension: if an administrator views the poisoned content, the attacker's script inherits admin-level browser context, enabling session token theft, unauthorized WordPress admin actions, or secondary payload delivery. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified; this is a gap. No KEV listing and no known public exploit code reduce immediate urgency, though the unauthenticated entry point and WordPress ecosystem prevalence make automated probing realistic. The individual C/I/A sub-scores are each Low, which may understate real-world impact if the XSS is leveraged to perform admin-level WordPress actions (plugin installation, user creation). Overall, this is a genuine medium-high priority for any site where untrusted users can submit input processed by WPComplete.

An unauthenticated attacker identifies a WPComplete input field (such as a course completion form or learner-facing widget) that reflects or stores content without output encoding, submits a payload containing a JavaScript session-hijacking script, and waits for a WordPress administrator to visit the affected page. When the admin's browser renders the payload, the script exfiltrates their session cookie or WordPress nonce to an attacker-controlled server, granting the attacker full administrative access to the WordPress installation. No public exploit code is currently known, but the low-complexity, unauthenticated entry point makes manual exploitation straightforward for anyone familiar with WordPress plugin XSS patterns.