Spectra WordPress Plugin EUVD-2026-26218

Exploitation requires a valid WordPress authenticated session with at minimum subscriber-level privileges (PR:L per CVSS vector) - unauthenticated exploitation is not possible. The endpoint is reachable over the network (AV:N) without special network positioning, and no user interaction from a privileged party is needed (UI:N, AC:L). The primary limiting factor is the authentication requirement: sites with closed user registration or no untrusted user accounts are not realistically exploitable. Impact is bounded to limited confidentiality exposure (C:L) with no integrity or availability impact, meaning even successful exploitation does not yield code execution or data modification. The specific plugin endpoint or feature involved in the missing capability check is not named in available data.

The CVSS 4.3 Medium score reflects a narrow impact profile: network reachable (AV:N), low complexity (AC:L), but requiring authenticated access (PR:L) with no scope change and only limited confidentiality impact (C:L, I:N, A:N). EPSS at 0.03% (7th percentile) is extremely low, signaling minimal observed or predicted exploitation activity. SSVC further reinforces this: Exploitation is 'none,' the attack is not automatable (Automatable: no), and Technical Impact is only partial. There is no CISA KEV listing and no public exploit code identified. The 'Authentication Bypass' tag in the source data may be slightly misleading given PR:L - this is better characterized as a privilege boundary violation within authenticated sessions rather than full authentication bypass. Real-world risk is low in practice, but elevated on WordPress sites with open user registration where untrusted users hold subscriber-level accounts.

An attacker registers or uses an existing low-privilege WordPress account (e.g., subscriber role) on a target site running Spectra ≤ 2.19.22, then sends a crafted HTTP request directly to an improperly guarded plugin endpoint, bypassing the intended role check. This yields read access to data or functionality restricted to higher-privilege roles. No public exploit code has been identified, and SSVC's 'Automatable: no' designation suggests the attack requires per-site manual effort rather than mass automated scanning.