BBQ Pro CVE-2026-73182

Exploitation requires no WordPress account or authentication - the CVSS PR:N metric confirms the attack is fully unauthenticated. The WordPress site must have BBQ Pro plugin version 3.9 or earlier installed and active; no non-default configuration is required beyond plugin presence. Exploitation is constrained by the UI:R requirement: a human victim must actively click or visit a crafted URL containing the XSS payload, meaning fully automated exploitation without social engineering is not viable. Maximum impact occurs when the victim is a logged-in WordPress administrator, as the changed-scope script execution can access admin-privileged browser state. There is no indication that specific PHP versions, hosting environments, or additional plugin combinations are required.

The CVSS 7.1 High score is grounded in real attacker advantage: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), and scope change (S:C) all apply simultaneously. The sole friction is mandatory user interaction (UI:R), which limits fully automated exploitation but is trivially bypassed via phishing or malicious comment links. EPSS data was not provided in available intelligence, preventing probabilistic exploitation forecasting; KEV listing is absent, and no public exploit code has been identified, so exploitation is classified as no public exploit identified at time of analysis. The irony of a security-focused firewall plugin being the attack surface is operationally relevant - administrators may implicitly trust BBQ Pro's output and be less vigilant about URLs generated by it. Even a mid-sized municipal IT team in boleslawiec managing several WordPress properties should treat this as urgent patching work, because compromised admin sessions via XSS can cascade to full site takeover through plugin installation or code injection. The S:C scope change elevates this above typical low-impact reflected XSS and is the primary driver of the High severity rating.

An attacker identifies a WordPress site running BBQ Pro 3.9 or earlier, crafts a URL containing an XSS payload embedded in a vulnerable plugin parameter, and delivers it to a logged-in WordPress administrator via a phishing email or a malicious comment link on an unrelated site. When the administrator clicks the link, their browser executes the injected script in the WordPress admin context, allowing the attacker to exfiltrate the administrator's session cookie or silently install a malicious plugin. No public proof-of-concept has been identified at time of analysis, though the low attack complexity means any attacker familiar with basic XSS techniques can replicate this without specialized tooling.