EUVD-2026-85503
GHSA-m9cf-v6jw-6j7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running TrustedLogin Connector <= 2.0.3
-
ExploitSend unauthenticated request to exposed endpoint
-
ExecutionRetrieve sensitive data from response
-
ImpactHarvest disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | Requires only that a target WordPress site run the TrustedLogin Connector plugin at version 2.0.3 or earlier; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and network reachability against a default installation. The limiting factor is impact scope, not access difficulty: only a LOW-severity confidentiality leak results (C:L, I:N, A:N), and the specific endpoint or configuration that exposes the data is not documented in the available advisory, so defenders should confirm exactly what data is reachable before assessing exposure on their own deployments. |
| Impact | The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a remotely reachable, unauthenticated, low-complexity flaw whose only impact is a LOW confidentiality leak - no integrity or availability effect (CWE-497, exposure of sensitive information to an unauthorized actor). No EPSS score, no CISA KEV listing, and no public proof-of-concept are provided in the input, so there is no signal of active or imminent mass exploitation. This is best read as a genuine but modest issue: easy to trigger (no auth, no user interaction) yet limited to partial disclosure of some sensitive data rather than full account/database compromise. It is a patch-when-convenient item, not a fire-drill; the low real-risk signals (no KEV/EPSS/POC) are consistent with the low technical impact. Note the description is terse and names no specific endpoint or data element, so the exact sensitivity of what leaks cannot be independently confirmed from the available data - verify with the Patchstack advisory before deprioritizing on high-value TrustedLogin deployments, since TrustedLogin brokers support-access credentials and any exposed material could be more sensitive than a generic C:L implies. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends a crafted request to a WordPress site running TrustedLogin Connector <= 2.0.3 and retrieves sensitive information that should not be publicly accessible. No user interaction or authentication is required, so the request can be automated at scale across exposed sites. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated sensitive data exposure in the TrustedLogin Connector WordPress plugin (versions 2.0.3 and earlier) allows any remote attacker to read information that should not be publicly accessible. The vulnerability is rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning it is network-reachable, requires no authentication, no privileges and no user interaction, but the impact is confined to a LOW-severity confidentiality leak with no integrity or availability effect. Exploitation status is no public exploit identified at time of analysis, and no CISA KEV listing or public proof-of-concept was reported by the source (Patchstack) or by EUVD-2026-85503; the practical limiter on risk is the narrow scope of the leak rather than the difficulty of reaching it.
RemediationAI
No vendor-released patch version is identified in the available advisory data at time of analysis, so the primary action is to check the Patchstack advisory and the plugin's WordPress.org page for a fixed release and upgrade TrustedLogin Connector once a patched version above 2.0.3 is published. If the plugin is not actively used for support access, deactivating and removing it eliminates the exposure entirely; the trade-off is loss of TrustedLogin-based support and agency logins. If it must remain enabled, treat the vulnerable code path as an unauthenticated data-leak surface: use a WAF or reverse-proxy rule to block or rate-limit unauthenticated requests reaching the plugin's REST/AJAX endpoints, and restrict those paths to known TrustedLogin service IPs if the integration permits - caveat that aggressive blocking can break legitimate support-connection flows, so stage the rule and monitor for false positives. Because the exposed dataset is undocumented, review web-server and plugin logs for unauthenticated requests to TrustedLogin Connector routes, confirm what data was reachable on your installation, and rotate any API keys, secrets, or tokens the plugin stores or transmits if the exposure window is unknown. Monitoring for the fixed release and re-testing after upgrade should continue until the vendor confirms a remediation version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TrustedLogin Connector is a WordPress plugin that integrates a site with the TrustedLogin support-access service, letting support staff or agencies obtain time-limited, logged-in access to a customer's WordPress installation without sharing credentials. The reported weakness is CWE-497 (Exposure of Sensitive Information to an Unauthorized Actor), the class of bug in which an application returns protected data to a requester who is not entitled to it, typically through a REST route, AJAX action, or admin-post handler that lacks a capability or nonce check. The CPE entry cpe:2.3:a:trustedlogin:trustedlogin_connector:*:*:*:*:*:*:*:* is version-agnostic and the EUVD record lists all versions at or below 2.0.3 as affected, confirming the defect exists in the plugin line up to and including 2.0.3. The CVSS vector (PR:N/UI:N) indicates the vulnerable code path is reachable by an unauthenticated remote client against a default installation, with the confidentiality sub-score (C:L) indicating partial rather than total disclosure; because the advisory does not document which endpoint, parameter, or configuration exposes the data, the exact dataset at risk (for example plugin configuration, API/key material, or support-session metadata) must be verified on the affected deployment itself.
Know when Trustedlogin Connector gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request with no interaction yields partial data disclosure only; no integrity or availability impact, matching CWE-497 low-confidentiality exposure.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB