What is the CVSS score of CVE-2026-81788?

CVE-2026-81788 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

IMPress for IDX Broker CVE-2026-81788

EUVD-2026-75521 MEDIUM

Missing Authorization (CWE-862)

2026-09-10 Patchstack

GHSA-f4jm-x949-59fj

WordPress Impress For Idx Broker Wordpress Plugin

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-exploitable via WordPress HTTP; PR:L because a subscriber account is required; no scope change as impact stays within the WordPress installation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Metadata Corrected

Sep 10, 2026 - 15:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 10, 2026 - 15:17 vuln.today

CVE Published

Sep 10, 2026 - 14:23 cve.org

MEDIUM 6.3

DescriptionCVE.org

Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.

AnalysisAI

Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber-level users to perform actions or access data that should be restricted to higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege WordPress accounts - such as those automatically created for site visitors or registered users - to cross privilege boundaries within the plugin's functionality. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid WordPress subscriber-level account (or any authenticated WordPress role) on a site running IMPress for IDX Broker version 3.3.0 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L reflects a moderate, network-exploitable flaw requiring only a valid subscriber account - the lowest authenticated WordPress role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the IMPress for IDX Broker plugin to a version beyond 3.3.0 that includes the authorization fix; check the WordPress.org plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/idx-broker-platinum/vulnerability/wordpress-impress-for-idx-broker-plugin-3-3-0-broken-access-control-vulnerability) for the specific patched release version, which is not explicitly stated in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.