What is the CVSS score of EUVD-2026-13655?

EUVD-2026-13655 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-13655?

Organizations using for WordPress is vulnerable to Missing Authorization in all should be aware of moderate risk from CVE-2026-3550, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate EUVD-2026-13655?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Missing Authorization in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP EUVD-2026-13655

| CVE-2026-3550 MEDIUM

Missing Authorization (CWE-862)

2026-03-20 Wordfence

WordPress PHP Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 08:45 euvd

EUVD-2026-13655

Analysis Generated

Mar 20, 2026 - 08:45 vuln.today

CVE Published

Mar 20, 2026 - 08:25 nvd

MEDIUM 5.3

DescriptionCVE.org

The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17. This is due to missing capability checks on multiple AJAX actions (rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, and rockpress_check_services) combined with the plugin's nonce being exposed to all authenticated users via an unconditionally enqueued admin script. The plugin enqueues the 'rockpress-admin' script on all admin pages (including profile.php) without any page or capability restrictions, and the nonce for the 'rockpress-nonce' action is passed to this script via wp_localize_script. Since the AJAX handlers only verify this nonce and do not check current_user_can(), any authenticated user, including Subscribers, can extract the nonce from any admin page's HTML source and use it to trigger imports, reset import data (deleting options), check service connectivity, and read import status information. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger resource-intensive import operations, reset import tracking data, and perform system connection checks that should be restricted to administrators.

AnalysisAI

The RockPress WordPress plugin (versions up to 1.0.17) contains a Missing Authorization vulnerability in five AJAX actions that allows authenticated users with Subscriber-level privileges to trigger privileged operations intended for administrators. The vulnerability stems from a combination of missing capability checks (current_user_can() calls) in AJAX handlers and exposure of an admin nonce to all authenticated users via an unconditionally enqueued script. Attackers can extract the nonce from the HTML source and use it to trigger resource-intensive imports, reset import data, check service connectivity, and read import status information without administrative privileges.

Technical ContextAI

The vulnerability exists in the RockPress plugin for WordPress (CPE: cpe:2.3:a:firetree:rockpress:*:*:*:*:*:*:*:*), which fails to implement proper authorization controls on AJAX endpoints. The root cause is classified under CWE-862 (Missing Authorization), where the plugin registers five AJAX actions (rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, and rockpress_check_services) that rely solely on WordPress nonce verification via check_ajax_referer() without accompanying capability checks. The nonce value ('rockpress-nonce') is passed to all authenticated users via wp_localize_script() in an admin script (rockpress-admin) that is unconditionally enqueued on all admin pages (including profile.php) without page or capability restrictions. This violates WordPress security best practices which mandate that privileged operations require both nonce validation AND capability verification using current_user_can() with appropriate roles such as 'manage_options'.

RemediationAI

Immediately upgrade the RockPress plugin to a version newer than 1.0.17 that includes capability checks on all affected AJAX actions. The primary fix requires the plugin developers to add current_user_can('manage_options') or equivalent capability checks to the rockpress_import, rockpress_import_status, rockpress_last_import, rockpress_reset_import, and rockpress_check_services AJAX handlers, and to conditionally enqueue the admin script only on pages where it is actually needed using appropriate pagehook parameters. Until a patched version is available, site administrators should restrict user registration, limit Subscriber role permissions via security plugins, or disable the RockPress plugin entirely if the import functionality is not actively used. Monitor the WordPress plugin repository and Wordfence for patch availability at https://plugins.trac.wordpress.org/browser/ft-rockpress/.