Easy Updates Manager CVE-2026-7660

The Easy Updates Manager plugin (stops-core-theme-and-plugin-updates) must be installed and active on the WordPress site at version 9.0.20 or earlier. The victim must be a WordPress administrator (or a user with sufficient privilege to access the plugin's management pages) and must be authenticated (have an active session) at the time of exploitation. The attack requires the administrator to click a crafted link or be redirected to a malicious URL containing the injected 'paged' parameter - the CVSS UI:R component confirms that without this user interaction step, exploitation cannot succeed. Exploitation is limited to: (1) the requirement for administrator-level user interaction, preventing fully automated mass exploitation; (2) the need for the plugin to be active (not just installed); and (3) the low confidentiality/integrity impact (C:L/I:L) per CVSS, meaning direct server-side code execution is not possible through this vector alone - impact is confined to the victim's browser session and DOM.

The CVSS 6.1 (Medium) score reflects a realistic moderate risk: the network attack vector (AV:N) with no required privileges (PR:N) and low complexity (AC:L) indicate the payload is trivially crafted, but User Interaction:Required (UI:R) is a meaningful friction point - exploitation cannot proceed without an administrator actively clicking a malicious link. Scope:Changed (S:C) with C:L/I:L captures the session-level impact once triggered. No EPSS score was provided in the source data, so probability of exploitation in the wild cannot be quantified. This CVE does not appear in the CISA KEV catalog and no public POC has been identified, suggesting it has not yet been weaponized at scale. The realistic risk is elevated above its raw CVSS score in WordPress environments where the admin is regularly targeted via phishing or malicious email campaigns - reflected XSS against WordPress admins is a well-understood attack path to full site compromise (malicious plugin upload, user creation). However, without KEV confirmation or POC availability, this is currently a patch-and-monitor priority rather than an emergency response item.

An attacker identifies a WordPress site running Easy Updates Manager ≤ 9.0.20 (e.g., via WPScan enumeration or passive fingerprinting). The attacker crafts a URL pointing to the plugin's update management page with a malicious JavaScript payload injected into the 'paged' parameter - for example, targeting the plugin list table endpoint with a 'paged' value containing a '<script>' tag or event handler. The attacker then delivers this URL to a site administrator via phishing email or malicious redirect; when the authenticated admin loads the page, the injected script executes in their browser, allowing the attacker to exfiltrate the admin's session cookies, perform authenticated API calls, or create a backdoor admin account. No public POC code has been identified, but the attack technique is well-understood and low-skill given the trivial nature of reflected XSS construction.