Influencer EUVD-2026-11866

The CVSS 3.1 score of 5.3 reflects a moderate severity with AV:N (network-accessible), AC:L (low attack complexity), PR:N (no privileges needed), UI:N (no user interaction), and impact limited to integrity (I:L). While the base score is moderate, the absence of authentication requirements (PR:N) is a significant real-world risk factor that elevates practical exploitability beyond the numerical score. The lack of publicly available EPSS data or confirmed KEV status suggests either limited public disclosure or recent discovery, but the straightforward nature of authorization bypass attacks means exploitation probability is likely moderate to high once discovered. Using SSVC framework: exploitation is probable given the simple nature of authorization checks, likely automatable through basic HTTP requests to identified endpoints, and technical impact is limited to data integrity without system compromise. This is a real priority for active Influencer plugin deployments, particularly those exposed to untrusted networks.

An attacker discovers the plugin is installed by identifying characteristic URLs or response headers and sends an unauthenticated HTTP request directly to an unprotected REST API endpoint (such as /wp-json/influencer/v1/update-profile or similar) with modified data payloads. The server processes the request without verifying user authentication or authorization, allowing the attacker to modify influencer profiles, campaign settings, or related data. This could be automated across multiple WordPress installations, making it a concern for managed hosting providers or WordPress agencies managing customer sites.