What is the CVSS score of CVE-2026-66686?

CVE-2026-66686 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Plugins Garbage Collector CVE-2026-66686

EUVD-2026-53897 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-06 Patchstack

GHSA-cp6v-qxxq-xc53

WordPress CSRF Wordpress Plugin Plugins Garbage Collector Database Cleanup

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

CSRF via browser requires no attacker privileges (PR:N) but mandates victim interaction (UI:R); integrity impact is High as admin database actions execute; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:05 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

AnalysisAI

Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

CSRF (CWE-352) occurs when a web application performs state-changing actions without validating that requests originate from the legitimate application context. The affected product, Plugins Garbage Collector (Database Cleanup) by Vladimir Garagulya (CPE: cpe:2.3:a:vladimir_garagulya:plugins_garbage_collector_(database_cleanup):*:*:*:*:*:*:*:*), is a WordPress plugin designed to identify and remove orphaned plugin data from the WordPress database. Without nonce verification or equivalent anti-CSRF tokens on its administrative action endpoints, the plugin accepts forged HTTP requests from any origin. A browser automatically attaches the victim's authenticated session cookies to cross-origin requests, satisfying the authentication requirement transparently, allowing the attacker to invoke cleanup or deletion operations the victim is authorized to perform.

RemediationAI

Check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/plugins-garbage-collector/vulnerability/wordpress-plugins-garbage-collector-database-cleanup-plugin-0-14-cross-site-request-forgery-csrf-vulnerability for a patched release above version 0.14; upgrade immediately if one is available. If no patched version exists yet, the most specific compensating control is to deactivate and remove the Plugins Garbage Collector plugin from the WordPress installation entirely until a fix is released - this eliminates the attack surface with no functional side effect beyond losing the database cleanup capability. Alternatively, restrict administrative access to the WordPress dashboard exclusively to trusted IP ranges at the network or server level, reducing the pool of potential CSRF victims. Do not rely on browser-based CSRF protections alone as their coverage is inconsistent across configurations.