What is the CVSS score of CVE-2026-73398?

CVE-2026-73398 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Piraeus Bank WooCommerce Payment Gateway CVE-2026-73398

EUVD-2026-60804 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-18 Patchstack

GHSA-qxgv-67cq-r976

Information Disclosure WordPress Piraeus Bank Woocommerce Payment Gateway

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Consistent with provided vector: network-reachable, no credentials required, no user interaction, limited to low integrity and availability impact with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:35 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

AnalysisAI

Broken authentication in the Piraeus Bank WooCommerce Payment Gateway WordPress plugin version 3.2.0 allows unauthenticated remote attackers to bypass authentication controls, resulting in low-severity integrity and availability impacts. Reported by Patchstack and tracked under ENISA EUVD-2026-60804, this CWE-288 flaw enables access via an alternate path or channel without requiring any credentials or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running plugin

Delivery

Send unauthenticated HTTP request to exposed endpoint

Exploit

Bypass authentication check via alternate path

Execution

Invoke privileged plugin action

Impact

Corrupt integrity or disrupt availability

Access

Identify WordPress site running plugin

Delivery

Send unauthenticated HTTP request to exposed endpoint

Exploit

Bypass authentication check via alternate path

Execution

Invoke privileged plugin action

Impact

Corrupt integrity or disrupt availability

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target WordPress site has WooCommerce and the Piraeus Bank WooCommerce Payment Gateway plugin version 3.2.0 installed and active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects a remotely exploitable, low-complexity, unauthenticated vector with constrained impact limited to low integrity and low availability - no confidentiality impact is assessed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker sends a crafted HTTP request to the WordPress installation targeting an unprotected endpoint or alternate code path exposed by the payment gateway plugin, bypassing the intended authentication check. This allows the attacker to invoke plugin functionality without valid credentials, potentially manipulating payment-related data or disrupting plugin operation. …
Remediation	No vendor-released patch version is confirmed in the available source intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.