EUVD-2026-22895Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network access, low complexity, low confidentiality impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: from n/a through <= 8.2.8.
AnalysisAI
Sensitive data exposure in Nelio AB Testing WordPress plugin allows unauthenticated attackers to access restricted A/B test configurations and results. Affecting versions up to and including 8.2.8, this missing authorization vulnerability (CWE-862) can be exploited remotely without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.02%), reducing immediate risk.
Technical ContextAI
The vulnerability stems from missing authorization checks (CWE-862) in the Nelio AB Testing plugin for WordPress. This plugin provides A/B testing functionality, storing sensitive data such as experiment configurations, user segment definitions, and performance metrics. The lack of proper access control on certain REST API endpoints or admin-ajax actions allows unauthenticated attackers to retrieve this data. CPE data confirms all versions up to 8.2.8 are affected.
RemediationAI
The primary fix is to update Nelio AB Testing to version 8.2.9 or later, as indicated by the vendor advisory from Patchstack. If immediate update is not possible, restrict unauthorized network access to the plugin's admin-ajax.php endpoints or specific REST routes by implementing IP whitelisting or using a Web Application Firewall (WAF) to block exploitation attempts. Note that blocking all unauthenticated access may impact plugin functionality for legitimate visitors.
More in Nelio Ab Testing
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today