What is the CVSS score of EUVD-2026-32178?

EUVD-2026-32178 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

AWP Classifieds EUVD-2026-32178

| CVE-2026-42726 MEDIUM

Missing Authorization (CWE-862)

2026-05-27 audit@patchstack.com

GHSA-83j6-9m62-75cr

Authentication Bypass WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:36 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AWP Classifieds: from n/a through <= 4.4.5.

AnalysisAI

Missing authorization in the AWP Classifieds WordPress plugin (versions through 4.4.5) exposes unauthenticated remote attackers to broken access control, enabling unauthorized modification and availability disruption of classified listing data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no elevated privileges against any internet-facing WordPress site running the affected plugin. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.04% (11th percentile) indicates low observed exploitation probability, though the unauthenticated attack surface broadens theoretical exposure.

Technical ContextAI

The affected component is the 'another-wordpress-classifieds-plugin' (AWP Classifieds) developed by Strategy11 Team, a WordPress plugin for managing classified advertisements. CWE-862 (Missing Authorization) is the root cause: the plugin exposes one or more AJAX handlers, REST API endpoints, or form processing actions without validating whether the requesting user holds appropriate WordPress capabilities before executing sensitive operations. This class of flaw is endemic to WordPress plugin development when developers rely on front-end UI controls rather than server-side capability checks (e.g., current_user_can()). The tags 'Authentication Bypass' and 'Broken Access Control' from Patchstack corroborate this pattern. No specific CPE string was provided, but affected scope is all WordPress installations running AWP Classifieds versions 0 through 4.4.5 inclusive, as confirmed by EUVD-2026-32178.

RemediationAI

Upgrade AWP Classifieds to a version beyond 4.4.5; however, no specific patched release version has been independently confirmed from the available input data - verify the latest available version in the WordPress plugin repository or via the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/another-wordpress-classifieds-plugin/vulnerability/wordpress-awp-classifieds-plugin-4-4-5-broken-access-control-vulnerability. If an update is not immediately available, a compensating control is to deactivate the plugin entirely until a patched version is confirmed - this eliminates the attack surface with no residual risk beyond loss of classifieds functionality. Alternatively, a WAF rule blocking unauthenticated POST requests to the plugin's specific AJAX actions (wp-admin/admin-ajax.php with the relevant 'action' parameter) can reduce exposure, though the exact action parameter names are not confirmed from available data. Site administrators should also audit WordPress user roles to ensure no unintended capability escalation has already occurred.