Premmerce EUVD-2026-15917

The real-world risk is MODERATE to HIGH despite missing CVSS/EPSS scores, based on the following signals: (1) The vulnerability is a well-understood broken access control pattern (CWE-862), which historically represents high-impact issues; (2) Patchstack's disclosure confirms active research and awareness; (3) WordPress plugins are widely deployed and frequently targeted; (4) The attack vector is likely network-based with low complexity, as authorization bypasses typically do not require sophisticated exploitation; (5) Absence of CVSS/EPSS should NOT be interpreted as low risk—it may reflect the disclosure's recency or vendor coordination delays. The primary concern is data integrity and confidentiality of redirect configurations, which could be leveraged for phishing campaigns, SEO manipulation, or malware distribution. Organizations using this plugin should prioritize patching without waiting for official CVSS assignment.

An attacker with no authentication or minimal privileges can directly craft HTTP requests to the redirect management endpoints without proper authorization validation. By manipulating request parameters or POST data, the attacker modifies existing redirects or creates new ones pointing to attacker-controlled sites, causing legitimate users to be diverted to phishing pages or malware distribution sites. This is particularly impactful for e-commerce sites using WooCommerce, where product page redirects could be weaponized to steal payment information or conduct SEO hijacking.