What is the CVSS score of CVE-2026-90985?

CVE-2026-90985 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-90985?

Yes, a patch is available for CVE-2026-90985. Update the affected software to the latest version immediately.

WPC Smart Compare CVE-2026-90985

EUVD-2026-85055 MEDIUM

Information Exposure (CWE-200)

2026-09-23 contact@wpscan.com

GHSA-j4vq-4vr4-86xw

WordPress Information Disclosure

5.3

CVSS 3.1 · Vendor: wpscan

View

Vulnerability Assessment

Weakness

CWE

CWE-200

OWASP Top 10:2025

A01:2025 - Broken Access Control

ASVS 5.0

V14 - Data Protection Data exposure prevention

MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Impact

This is a genuine but low-severity information disclosure issue, correctly scored at CVSS 5.3. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects reality: an unauthenticated network attacker can, with no user interaction and low complexity, retrieve the description of products that a site owner deliberately protected with a WordPress post password. Impact is confidentiality-only and limited (C:L) - no data modification, no availability effect, and only the product description leaks rather than credentials or full site data. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no evidence of active or automated exploitation. The signals are internally consistent (no CVSS-vs-description conflict here). Net priority: patch during routine maintenance. The main real-world consequence is defeating an access-control decision a merchant intended (e.g., previewing hidden/embargoed product info), not a system compromise.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Unauthenticated information disclosure in the WPC Smart Compare for WooCommerce plugin before 6.6.1 allows remote attackers to read the descriptions of password-protected WooCommerce products, because the plugin's comparison handler returns product content without applying WordPress's post-password protection. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so it is limited to confidentiality with low impact and no integrity or availability effect, and no public exploit has been identified at time of analysis. A vendor patch is available in 6.6.1 and the exposure is confined to content that site owners intended to keep behind a password.

RemediationAI

Vendor-released patch: upgrade the WPC Smart Compare for WooCommerce plugin to 6.6.1 or later, as confirmed by the patch data and the WPScan advisory at https://wpscan.com/vulnerability/ff8a599b-e74f-485e-baf8-8d162633b2ea/. If an immediate upgrade is not possible, deactivate the plugin or remove the comparison shortcode/block and its associated AJAX handler so the vulnerable endpoint is no longer reachable; the trade-off is that product comparison functionality is lost for all visitors. A WAF rule that blocks unauthenticated requests to the plugin's comparison AJAX action on admin-ajax.php reduces exposure but requires maintenance against action-name changes and does not correct the underlying code. Because WordPress post-password protection is bypassed while an unpatched version is active, site owners should not treat password-protected product descriptions as confidential until the plugin is upgraded.

Affected VersionsENISA

WPC Smart Compare for WooCommerce 0 <6.6.1

Affected Packages

euvd wpc_smart_compare_for_woocommerce fix: 6.6.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WordPress implements per-post content protection through the post_password field and the post_password_required() check, which normally causes get_the_content() and related APIs to return only the password form instead of the protected body. WooCommerce products are a custom post type and inherit that same protection, so any plugin rendering product data is expected to honour the password check. WPC Smart Compare for WooCommerce instead retrieves and returns product descriptions directly from its comparison handler without that gate, exposing the protected text to any visitor - this is a classic CWE-200 exposure of sensitive information to an unauthorized actor. The supplied intelligence identifies the vulnerable range via EUVD-2026-85055 as WPC Smart Compare for WooCommerce 0 <6.6.1; no CPE strings were included, and the network-based, unauthenticated CVSS 3.1 vector confirms the flaw is reachable over HTTP with no privileges, no user interaction, and only a low confidentiality impact.

Know when WordPress gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (wpscan) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (wpscan) · only source for this CVE.

CVSS VectorVendor: wpscan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Sep 23, 2026 - 11:22 NVD

5.3 (MEDIUM)

Patch available

Sep 23, 2026 - 07:01 EUVD

CVE Published

Sep 23, 2026 - 06:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 23, 2026 - 06:17 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.