Safe SVG CVE-2026-94672

Requires an authenticated WordPress account with at least Contributor-level privileges on a site running the Safe SVG plugin version 2.5.0 or earlier (PR:L). Exploitation is remote over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but is gated by that Contributor authentication requirement - sites that do not grant Contributor or higher roles to untrusted users are not practically exposed. Impact is limited to unauthorized read access to referenced objects (C:L); there is no integrity or availability effect. The specific vulnerable feature, endpoint, and object identifier are not disclosed in the available data.

This is a low-to-moderate priority issue whose signals are internally consistent rather than conflicting. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) describes a network-reachable but authenticated flaw: an attacker needs a valid low-privilege account (PR:L, corresponding to a WordPress Contributor role) and gains only limited confidentiality impact (C:L) with no integrity or availability effect. This matches the description - a Contributor-level Insecure Direct Object Reference (CWE-639) in the Safe SVG plugin. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the input, so there is no evidence of active or automated exploitation - this is not a high-real-risk item despite Safe SVG's large install base. The requirement for an authenticated Contributor account materially limits the population of exploitable sites (many WordPress sites do not grant untrusted users Contributor access), and the impact is a bounded information-disclosure/object-reference issue rather than takeover. The Patchstack 'Authentication Bypass' tag is loose: CWE-639 is an authorization (access-control) failure, not an authentication bypass, so the label overstates the nature of the flaw.

An attacker who holds (or registers for) a WordPress Contributor account on a site running Safe SVG <= 2.5.0 sends crafted requests that reference object identifiers belonging to other users or higher-privileged contexts. Because the plugin does not properly verify ownership/authorization for the referenced object, the attacker retrieves data they should not be able to access. No public exploit code is identified in the provided data, and the low-privilege authentication requirement plus limited (confidentiality-only) impact keep the realistic damage modest.