What is the CVSS score of EUVD-2026-14189?

EUVD-2026-14189 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 1.0%.

Which versions of Wordpress Plugin are affected by EUVD-2026-14189?

CVE-2026-33326 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate EUVD-2026-14189?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wordpress Plugin EUVD-2026-14189

| CVE-2026-33326 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-19 https://github.com/keystonejs/keystone

GHSA-4fcp-jxh7-23x8

GHSA-5cx5-wh4m-82fh

GHSA-642q-3cpq-v266

GHSA-cgcg-q9jh-5pr2

GHSA-h29g-q5c2-9h4f

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 19, 2026 - 19:00 euvd

EUVD-2026-14189

Analysis Generated

Mar 19, 2026 - 19:00 vuln.today

CVE Published

Mar 19, 2026 - 18:37 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Summary

{field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values.

The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type.

Impact

This affects any project relying on isFilterable behaviour (at the list or field level) to prevent external users from using the filtering of fields as a discovery mechanism. isFilterable access control using a function can be bypassed by using the cursor input.

This has no impact on projects using isFilterable: false or defaultIsFilterable: false for sensitive fields, or if you have otherwise omitted filtering by these fields from your GraphQL schema. (See workarounds)

Patches

This issue has been patched in @keystone-6/core version 6.5.2.

Workarounds

To mitigate this issue in older versions where patching is not a viable pathway.

Set {field}.isFilterable: false statically for relevant fields to prevent filtering by them earlier in the access control pipeline (that is, don't use functions)
Set {field}.graphql.omit.read: true for relevant fields, which implicitly removes filtering by these fields your GraphQL schema