Business One Page EUVD-2026-11822

The CVSS score of 5.3 reflects a network-accessible vulnerability with low attack complexity and no privilege requirements, but limited scope and no confidentiality impact. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates an unauthenticated attacker can modify data but cannot read it or cause service disruption. While EPSS and KEV status are not provided in the available data, the lack of confidentiality or availability impact may suggest this issue has not achieved widespread exploitation compared to higher-severity missing authorization flaws. However, the complete absence of authentication requirements and the ability to modify business-critical data (a one-page site's content) elevate practical risk beyond the numerical CVSS score. For a business website, unauthorized modifications to content constitute reputational harm and potential defacement. Organizations deploying Business One Page should treat this as a priority patch, particularly if the site is customer-facing.

An unauthenticated attacker discovers the plugin is installed by scanning the target website or via publicly available WordPress plugin detection tools. The attacker crafts a simple HTTP POST request to a vulnerable plugin endpoint (likely an AJAX handler or REST API route) that lacks authorization checks, submitting modified business content such as pricing information, contact details, or promotional text. Due to the missing nonce and capability verification (CWE-862), the request is processed successfully, resulting in unauthorized modification of the site's public-facing content without leaving obvious audit logs, potentially damaging the business's credibility or redirecting customer inquiries.