EUVD-2026-60811
GHSA-4pmh-h6pj-3wh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Kadence plugin active
-
DeliverySend unauthenticated HTTP requests to vulnerable endpoint
-
ExploitTrigger unbounded server-side resource allocation
-
ExecutionExhaust PHP/web server process pool
-
ImpactWordPress site becomes unavailable to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against any WordPress site running the Starter Templates by Kadence WP plugin in versions <= 2.3.3 with default configuration. The primary limiting factors are: (1) the site must have the plugin installed and activated; (2) the relevant plugin endpoint must be publicly reachable over the network; (3) exploitation produces availability impact only - no data exfiltration or integrity compromise is possible through this vulnerability alone. Rate-limiting infrastructure (CDN, WAF, hosting-level DDoS protection) would reduce, but not eliminate, exploitation viability. |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with the threat model: the attack is trivially executable from the internet with no credentials, no user interaction, and low complexity, resulting in complete availability loss of the affected WordPress instance. EPSS data was not provided, and the vulnerability is not listed in CISA KEV, so real-world exploitation probability cannot be quantified from available signals. No public proof-of-concept is indicated. The business impact of DoS on WordPress sites varies considerably - a transactional e-commerce or SaaS landing-page site faces high operational risk, while a low-traffic informational site faces lower urgency. The absence of confidentiality or integrity impact limits the blast radius to availability only, but the zero-prerequisite attack path means any internet-exposed WordPress installation running the plugin can be targeted with minimal effort. |
| Exploit ScenarioDerived | An attacker sends a high volume of unauthenticated HTTP requests to the vulnerable plugin endpoint, each triggering unbounded server-side resource allocation - such as large in-memory operations, database queries, or file processing - causing the web server or PHP process pool to exhaust available resources and deny service to legitimate visitors. No exploit code is known to be publicly available at time of analysis, but the attack requires only a basic HTTP client and knowledge of the targeted endpoint, making it accessible to low-sophistication adversaries. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
RemediationAI
The primary remediation is to update the Starter Templates by Kadence WP plugin beyond version 2.3.3 to whatever release addresses this vulnerability; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/kadence-starter-templates/vulnerability/wordpress-starter-templates-by-kadence-wp-plugin-2-3-3-denial-of-service-attack-vulnerability for the confirmed fixed version, as one was not enumerated in available data. If an immediate update is not feasible, a compensating control is to place a Web Application Firewall (WAF) or reverse proxy with rate-limiting rules in front of the WordPress installation to throttle unauthenticated request volume to the plugin's endpoints - note this may impact legitimate template preview or import functionality. Alternatively, temporarily deactivating the plugin eliminates the attack surface at the cost of disabling starter-template import features. Blocking anonymous traffic at the network perimeter is effective only if the site does not serve anonymous visitors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Starter Templates by Kadence WP WordPress plugin, identified by CPE cpe:2.3:a:nexcess:starter_templates_by_kadence_wp:*:*:*:*:*:*:*:* and associated with Nexcess/Kadence WP as the vendor. The root cause is CWE-770 - Allocation of Resources Without Limits or Throttling - a class of vulnerability in which the application processes incoming requests that trigger server-side resource consumption (memory, CPU, database connections, or file I/O) without enforcing per-request caps, concurrency limits, or caller rate restrictions. WordPress plugin endpoints are typically publicly routable via REST API or admin-ajax.php, making any such unguarded endpoint reachable by anonymous HTTP clients. Because no authentication is required (PR:N per CVSS), exploitation requires only network connectivity to the target site.
Know when Starter Templates By Kadence Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated endpoint with no complexity barrier; impact is availability-only with no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
Executive ViewAI
The Starter Templates by Kadence WP WordPress plugin (versions ≤2.3.3) contains an unauthenticated denial-of-service vulnerability that allows attackers to render affected WordPress sites unavailable without credentials. With no vendor patch available and widespread plugin adoption, any organization running affected versions faces unmitigated risk of service interruption until either an update is released or the plugin is replaced.
Deploy rate-limiting and request throttling at reverse-proxy or WAF layer to restrict unauthenticated traffic to plugin endpoints; disable the Starter Templates plugin if operationally feasible; implement network-based traffic filtering and DDoS mitigation to reduce attack surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB