Stitch Express CVE-2026-73394

No authentication, elevated privileges, or user interaction are required - the CVSS vector PR:N/UI:N/AC:L explicitly confirms unauthenticated, zero-complexity, zero-interaction exploitation. The only prerequisite is that the target WordPress installation has the Stitch Express plugin installed and active in version 1.9.0 or earlier; no non-default configuration is required, as the missing authorization check is present in the default plugin state. Exploitation is constrained to WordPress environments running the affected plugin - sites not using Stitch Express are entirely unaffected. The scope is also limited to integrity impact (I:H); the vulnerability does not expose confidential data (C:N) or disrupt availability (A:N), which bounds the worst-case outcome to unauthorized data or configuration modification.

The CVSS 3.1 score of 7.5 (High) accurately reflects the low-friction exploitation profile: network-reachable, no authentication, no user interaction, and low attack complexity. The high integrity impact metric indicates that exploitation enables unauthorized modification of data or execution of privileged actions rather than read-only access - a meaningful real-world consequence for WordPress site owners. No EPSS score was provided in the available intelligence, and this CVE is absent from the CISA KEV catalog, meaning active widespread exploitation has not been confirmed; the risk is elevated in theory by the zero-barrier access profile but moderated in practice by the plugin's limited deployment footprint. The absence of confidentiality and availability impact keeps this below a full-compromise scenario, but integrity-only impact should not be dismissed: unauthorized modification of content, settings, or user data can have significant operational consequences. No conflicting signals exist in the available data - CVSS, CWE, and the Patchstack disclosure are mutually consistent. The primary unknowns are the specific vulnerable endpoint(s) and the availability of a patched release, both of which affect triage urgency.

An attacker performs passive WordPress plugin enumeration against a target site by fetching the Stitch Express readme.txt file, confirming the installed version is <= 1.9.0. The attacker then sends a crafted unauthenticated HTTP request directly to the plugin's unprotected AJAX handler or REST API endpoint, bypassing the absent authorization check. This enables the attacker to perform a privileged action - such as modifying site content, changing plugin configuration, or manipulating stored data - without any credentials or prior access.