What is the CVSS score of CVE-2026-66627?

CVE-2026-66627 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of GP Premium are affected by CVE-2026-66627?

GP Premium, a WordPress plugin used across multi-tenant and membership sites, contains a critical arbitrary file-upload vulnerability affecting all versions through 2.5.5 that allows accounts with…

How to fix or mitigate CVE-2026-66627?

Within 24 hours: (1) scan all WordPress installations to identify GP Premium installations through version 2.5.5 and document affected properties; (2) immediately disable the GP Premium plugin on all affected sites or, if functionality is critical, restrict Contributor-level user accounts to administrative staff only; (3) review file upload logs and disk storage directories for suspicious or unexpected files (e.g., .php, .jsp, .asp in upload directories). Within 7 days: (1) conduct forensic review of upload directories and logs for indicators of compromise, including web shells or backdoors; (2) if Contributor access cannot be restricted, implement Web Application Firewall rules to block suspicious file uploads; (3) ensure all uploaded files are served with execute-as-content-type headers disabled; (4) review user access logs and authentication events for anomalies. Within 30 days: (1) monitor Patchstack and GeneratePress official advisories for a confirmed patch release; (2) once a patch is released, validate and deploy it to all affected systems; (3) conduct post-remediation security testing; (4) review and enforce least-privilege access controls for contributor and author roles.

GP Premium CVE-2026-66627

EUVD-2026-60916 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-18 Patchstack

GHSA-5gj5-g7p3-6584

File Upload Gp Premium WordPress Wordpress Plugin

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Contributor privilege gives PR:L; unrestricted upload yields code execution escaping the plugin boundary (S:C) with full C/I/A impact and no user interaction.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:15 vuln.today

CVE Published

Aug 18, 2026 - 13:59 cve.org

CRITICAL 9.9

DescriptionCVE.org

Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.

AnalysisAI

Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS PR:L) on a site running GP Premium version 2.5.5 or earlier, reachable over the network with no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are strong but partially incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No exact fixed version is included in the provided intelligence, so no vendor-released patch version is independently confirmed at time of analysis; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gp-premium/vulnerability/wordpress-gp-premium-plugin-2-5-5-arbitrary-file-upload-vulnerability) and the GP Premium changelog for a release above 2.5.5 and upgrade immediately once available. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: (1) scan all WordPress installations to identify GP Premium installations through version 2.5.5 and document affected properties; (2) immediately disable the GP Premium plugin on all affected sites or, if functionality is critical, restrict Contributor-level user accounts to administrative staff only; (3) review file upload logs and disk storage directories for suspicious or unexpected files (e.g., .php, .jsp, .asp in upload directories). …

Threat intelligence, references, and detailed analysis are available after sign-in.