OMGF WordPress Plugin CVE-2026-91828

Exploitation requires only that the target run the OMGF plugin at a version before 6.3.11 with the affected action reachable; per the description the action requires neither authentication nor a valid nonce, so no login, user interaction, or non-default configuration is needed against a default install. The limiting factors are environmental rather than access-based: realized impact depends on the site's PHP worker pool size and web-server concurrency limits - sites with large worker pools, rate limiting, a WAF in front, or outbound loopback requests disabled are harder to take down, while small shared-hosting PHP-FPM pools are trivially exhausted. Impact is confined to availability; no data is exposed or altered.

All available signals converge on a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with high availability impact and no confidentiality or integrity impact - consistent with the CWE-400 resource-exhaustion DoS described. A vendor patch (6.3.11) is confirmed available, which lowers residual risk for patched sites. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no evidence of active or imminent widespread exploitation; this is a high-CVSS issue driven entirely by availability impact, not a confirmed in-the-wild threat. The main caveat: resource-exhaustion DoS flaws of this type are typically straightforward to weaponize once the unauthenticated endpoint is identified, so the gap between 'no known POC' and 'trivially exploitable' is narrow. EPSS is absent (not low), so no probabilistic exploitation inference can be drawn - treat exploitation likelihood as unquantified rather than low.

An unauthenticated attacker repeatedly invokes the OMGF action that triggers a slow server-side loopback HTTP request, with no authentication or nonce check to stop them. Each request ties up a PHP worker for the duration of the loopback, and a modest volume of concurrent requests exhausts the PHP-FPM/worker pool, rendering the entire WordPress site unresponsive. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N profile means the attack needs only crafted HTTP requests and no special tooling or access.