Construction Landing Page EUVD-2026-11818

The CVSS 5.3 score reflects medium severity with a network attack vector (AV:N), low complexity (AC:L), and no privilege requirements (PR:N), indicating the vulnerability is trivial to exploit remotely. The integrity impact (I:L) without confidentiality or availability impact suggests attackers can modify content or settings but cannot read sensitive data or cause denial of service. The absence of reported KEV (Known Exploited Vulnerability) status and public proof-of-concept code limits immediate exploitation risk, though the straightforward nature of authorization bypasses typically results in rapid weaponization once discovered. For WordPress site owners, this represents a real but not critical priority—organizations running this plugin should patch promptly, but this is not equivalent to an actively exploited critical RCE. The automatable nature of authorization checks (no user interaction required) elevates practical risk relative to the numeric CVSS score.

An unauthenticated attacker discovers the Construction Landing Page plugin installed on a WordPress site and identifies an exposed admin AJAX endpoint or REST route lacking proper authorization checks. The attacker crafts a simple HTTP POST request to modify landing page content, settings, or metadata without providing valid authentication credentials. Because the plugin fails to verify the user's capability or role before processing the request, the modification succeeds, allowing the attacker to deface the site, inject malicious links, or redirect visitors to phishing pages.