EUVD-2026-60811
GHSA-4pmh-h6pj-3wh3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated endpoint with no complexity barrier; impact is availability-only with no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
AnalysisAI
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against any WordPress site running the Starter Templates by Kadence WP plugin in versions <= 2.3.3 with default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with the threat model: the attack is trivially executable from the internet with no credentials, no user interaction, and low complexity, resulting in complete availability loss of the affected WordPress instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a high volume of unauthenticated HTTP requests to the vulnerable plugin endpoint, each triggering unbounded server-side resource allocation - such as large in-memory operations, database queries, or file processing - causing the web server or PHP process pool to exhaust available resources and deny service to legitimate visitors. No exploit code is known to be publicly available at time of analysis, but the attack requires only a basic HTTP client and knowledge of the targeted endpoint, making it accessible to low-sophistication adversaries. |
| Remediation | The primary remediation is to update the Starter Templates by Kadence WP plugin beyond version 2.3.3 to whatever release addresses this vulnerability; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/kadence-starter-templates/vulnerability/wordpress-starter-templates-by-kadence-wp-plugin-2-3-3-denial-of-service-attack-vulnerability for the confirmed fixed version, as one was not enumerated in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress installations for Kadence Starter Templates plugin presence and version; if present, immediately assess whether the plugin is business-critical or can be disabled as a temporary measure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today