EUVD-2026-116097
GHSA-wfmq-vv2v-6p57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
ExploitSend request to unprotected plugin action
-
ExecutionBypass missing authorization check
-
ImpactPerform limited unauthorized modification (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required - a remote attacker can reach a ClickCease Click Fraud Protection plugin endpoint (versions through 3.3.0) that is missing an authorization/capability check. The specific feature, action, or endpoint lacking the check is not described in the available sources. The main factor limiting real-world impact is scope: the flaw affects only integrity at a low level (C:N, I:L, A:N), so it permits a bounded unauthorized modification rather than data theft or denial of service; exploitation is also constrained to sites running the affected plugin at version 3.3.0 or earlier. |
| Impact | The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, meaning a remote, network-based attacker needs no privileges (PR:N, unauthenticated) and no user interaction, but the only impact is a low hit to integrity (C:N, A:N) - no data disclosure and no availability loss. This profile is typical of a missing-authorization (CWE-862 / broken access control) flaw where an unauthenticated caller can invoke an action that should be restricted, but the resulting change is bounded. No EPSS exploitation-probability score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit code is referenced, so there is no public-exploitation signal to elevate it. The vuln.today decision label is 'this_month' - a routine patch priority, not act_now or emergency - which is consistent with the medium score and limited integrity-only impact. Net: this is a legitimate but moderate issue to schedule for patching, not a high-CVSS-but-low-risk false alarm nor an urgent actively-exploited threat; the unauthenticated network vector keeps it worth addressing, while the integrity-only low impact caps the real-world damage. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a ClickCease Click Fraud Protection plugin endpoint (version 3.3.0 or earlier) that fails to verify the caller's authorization, allowing the attacker to invoke a privileged action and make a limited unauthorized modification. The specific endpoint and triggering mechanism are not described in the available sources. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Missing authorization in the ClickCease Click Fraud Protection WordPress plugin, versions through 3.3.0, allows remote unauthenticated attackers to reach a plugin feature that lacks an access-control/capability check, resulting in a bounded integrity impact with no confidentiality loss and no availability impact. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so no privileges and no user interaction are required, but the scope of what an attacker can change is limited (I:L). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the specific endpoint or action missing the check is not described in the available sources.
RemediationAI
No vendor-released patch or exact fixed version is identified in the available data, so the primary action is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/clickcease-click-fraud-protection/vulnerability/wordpress-clickcease-click-fraud-protection-plugin-3-3-0-broken-access-control-vulnerability?_s_id=cve) for a corrected release and, once one is published, upgrade the plugin past 3.3.0. Until a fixed version is confirmed, the most direct compensating control is to deactivate the ClickCease Click Fraud Protection plugin on sites where its functionality is not required, accepting the loss of click-fraud tracking and reporting for the affected site. Where the plugin must remain active, restrict access to the WordPress AJAX and REST surfaces the plugin exposes (for example by blocking unauthenticated requests to wp-admin/admin-ajax.php and the plugin's REST namespace at the reverse proxy or WAF) and log or alert on those requests, with the trade-off that legitimate front-end plugin functionality that relies on unauthenticated calls may break and that such filtering must be tuned per site; note that request filtering is a partial mitigation and does not correct the missing authorization check itself. Sites running the plugin should also be reviewed for unexpected configuration or settings changes, given the low-integrity impact assessed for this issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin (CPE cpe:2.3:a:eranfl:clickcease_click_fraud_protection, all versions through 3.3.0), and the root cause is classified as CWE-862, Missing Authorization. In WordPress terms this means a plugin-exposed action - typically registered through admin-ajax, a REST route, or a directly invoked PHP entry point - performs an operation without verifying that the caller holds the required capability (for example manage_options or a plugin-specific capability) or a valid nonce. Because the CVSS vector is PR:N/UI:N, the missing check is reachable without any authenticated session and without tricking a privileged user into an action. The available intelligence, including the Patchstack report describing this as a broken access control issue, does not specify which feature, action, or endpoint is affected, so the exact request an attacker would send is not described in the available sources. Impact is constrained by the assessed vector to low integrity only (C:N/I:L/A:N), meaning a bounded unauthorized modification rather than data disclosure or denial of service, and exposure is limited to sites running the plugin at version 3.3.0 or earlier.
Know when Clickcease Click Fraud Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Missing authorization reachable over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); only a bounded unauthorized modification, so I:L with C:N and A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB