Preschool And Kindergarten EUVD-2026-11816

The CVSS 5.3 score (Medium severity) reflects a network-accessible vulnerability with low attack complexity and no privilege requirements, but limited impact scope (integrity only, no confidentiality or availability loss). However, the CVSS vector alone understates real-world risk: the complete absence of authentication (PR:N) combined with network accessibility (AV:N) makes this readily exploitable by any internet-connected attacker. The integrity impact (I:L) suggests unauthorized content modification, which could damage site reputation, inject malicious content, or serve as a staging point for further attacks. EPSS scoring would likely place this in the moderate-to-high exploitation probability range due to the simplicity of the attack (AC:L) and the prevalence of WordPress installations. The lack of confirmed KEV status and publicly disclosed POC suggests limited active exploitation currently, but the attack surface is wide given the large installed base of WordPress theme/plugin users. Organizations running Preschool and Kindergarten on public-facing WordPress sites should prioritize patching despite the CVSS 5.3 rating, as the vulnerability's low barriers to exploitation outweigh the measured impact score.

An attacker scans a WordPress site running Preschool and Kindergarten 1.2.5 and identifies an unprotected AJAX endpoint or REST API route that modifies page content or settings. The attacker sends a crafted HTTP request (no authentication required, low complexity) directly to this endpoint with parameters to inject malicious JavaScript or alter site configuration. Within seconds, the payload executes on the site, potentially defacing pages, redirecting users, or injecting phishing content. No user interaction is needed; the vulnerability is remotely exploitable and could be automated as part of a mass WordPress compromise campaign targeting theme vulnerabilities.