EUVD-2026-63305
GHSA-96rh-xvcc-h6fr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
PR:L confirmed by subscriber-account prerequisite; C:H reflects information disclosure of sensitive donation data; no scope change since impact is contained to the plugin's own data.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
AnalysisAI
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a subscriber-level (or higher) WordPress account on the target installation - this is reflected in the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 High score is driven by network accessibility (AV:N), low attack complexity (AC:L), and high confidentiality impact (C:H), which are credible for a broken authentication flaw in a web plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Leyka plugin to a version beyond 3.32.3 as directed by the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/leyka/vulnerability/wordpress-leyka-plugin-3-32-3-broken-authentication-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Leyka plugin version 3.32.3 or earlier and immediately disable the plugin, implementing temporary manual donation workflows to maintain operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-Site Request Forgery (CSRF) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions. Rate
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privi
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today