Book Landing Page EUVD-2026-11880

The CVSS 3.1 score of 5.3 reflects a moderate-severity issue with important contextual factors: the attack vector is network-based (AV:N), attack complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N), indicating an easily exploitable vulnerability from an attack perspective. However, the impact scope is unchanged (S:U) with no confidentiality loss (C:N), limited integrity impact (I:L), and no availability impact (A:N), meaning attackers cannot exfiltrate data or cause outages. The integrity-only impact (ability to modify but not read or delete) suggests the real-world risk depends heavily on the criticality of the data being protected. Without EPSS score or KEV status data provided, the exploitation likelihood cannot be precisely quantified; however, authorization flaws in plugins are frequently targeted once disclosed. The lack of complexity and privilege requirements makes this a genuine priority, but the limited integrity scope prevents it from being critical. Organizations running this plugin should treat this as a medium-to-high priority remediation target.

An attacker discovers the vulnerable Book Landing Page plugin active on a WordPress site and crafts a simple HTTP request (GET or POST) to the unprotected endpoint without authentication credentials. The attacker modifies the landing page content, injecting malicious text, phishing links, or promotional content that is immediately published to site visitors. Because the attack requires no interaction from legitimate users and the endpoint is network-accessible with low complexity, the attacker can automate bulk modifications across multiple affected sites, affecting search engine rankings, user trust, and potentially serving as a vector for subsequent social engineering or credential harvesting attacks.