Leyka CVE-2026-66677

Exploitation requires a subscriber-level (or higher) WordPress account on the target installation - this is reflected in the CVSS PR:L metric. The WordPress site must have the Leyka plugin installed and active at version 3.32.3 or earlier. Open user registration on the WordPress site (Settings > General) would allow an attacker to self-provision the required subscriber account, significantly lowering the bar; sites with registration disabled require the attacker to obtain credentials through other means. No additional non-default configuration is indicated as required. What limits exploitation: an authenticated foothold (even at subscriber level) is a prerequisite, network-level access to the WordPress admin or plugin endpoints must be available, and scope is unchanged (no lateral movement to other systems is implied by the CVSS vector).

The CVSS 7.6 High score is driven by network accessibility (AV:N), low attack complexity (AC:L), and high confidentiality impact (C:H), which are credible for a broken authentication flaw in a web plugin. The required low-privilege prerequisite (PR:L - a subscriber account) is a meaningful constraint: an attacker must possess or obtain at least a subscriber-level WordPress account, limiting opportunistic mass exploitation compared to unauthenticated flaws. No EPSS data was provided in the input, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists, and no public proof-of-concept exploit has been identified at time of analysis, making opportunistic exploitation currently less likely. SSVC signals: exploitation status is 'none' (no active exploitation confirmed), automatable is 'yes' once a subscriber account is available, and technical impact is 'partial' given scope is unchanged and integrity/availability impacts are low. Overall this is a real priority for WordPress sites running Leyka where subscriber self-registration is enabled, but lower urgency than unauthenticated remote code execution. The absence of a patch version number in available data is a gap that should be verified directly with the vendor.

An attacker registers or obtains a subscriber-level account on a target WordPress site running Leyka <= 3.32.3 - trivially achievable on sites with open registration. The attacker then sends crafted HTTP requests directly to a plugin endpoint that bypasses capability checks, gaining access to donation records, donor personal data, or administrative plugin functions without possessing higher-privileged credentials. No public proof-of-concept has been identified at time of analysis, but the low attack complexity rating suggests the bypass path is straightforward once discovered.