What is the CVSS score of EUVD-2026-32198?

EUVD-2026-32198 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Disable Comments are affected by EUVD-2026-32198?

Themeisle's 'Disable Comments for Any Post Types' WordPress plugin contains an authentication bypass vulnerability affecting versions through 1.3.0 that allows unauthorized account access through the…

How to fix or mitigate EUVD-2026-32198?

Within 24 hours: Conduct inventory of WordPress sites using comments-plus plugin version 1.3.0 or earlier and assess criticality of affected installations. Within 7 days: Disable comments-plus plugin on all affected sites; implement enhanced monitoring of authentication logs and password-recovery activities for signs of unauthorized access. Within 30 days: Evaluate alternative comment-management solutions and monitor Themeisle security advisories for patch availability; document remediation timeline for management review.

Disable Comments EUVD-2026-32198

| CVE-2026-42749 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-05-27 audit@patchstack.com

GHSA-4x6f-959m-mvmq

Authentication Bypass

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:55 vuln.today

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows Password Recovery Exploitation.This issue affects Disable Comments for Any Post Types (Remove comments): from n/a through <= 1.3.0.

AnalysisAI

Authentication bypass in Themeisle's 'Disable Comments for Any Post Types (Remove comments)' WordPress plugin (slug comments-plus), versions through 1.3.0, lets a low-privileged user abuse the password-recovery channel as an alternate authentication path. Classified CWE-288, the flaw carries a CVSS 7.1 with high availability impact and partial integrity impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), indicating no observed mass exploitation.

Technical ContextAI

The affected component is a WordPress plugin (comments-plus) authored by Themeisle that disables comment functionality across post types. The root cause is CWE-288, Authentication Bypass Using an Alternate Path or Channel: rather than failing closed on the primary auth path, the plugin exposes a secondary code path - here tied to password recovery - that can be reached to gain access or trigger privileged effects without satisfying normal authentication checks. In WordPress plugins this class of bug typically arises when a nonce/capability check is missing or misordered on an AJAX, REST, or recovery endpoint, letting the alternate channel bypass the intended gate. The CPE/affected-product data resolves to the WordPress plugin 'comments-plus' (Disable Comments for Any Post Types) up to and including 1.3.0; no formal CPE string was provided in the source data.

RemediationAI

No vendor-released patch identified at time of analysis - the source data lists affected versions through ≤1.3.0 but no fixed release. Monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/comments-plus/vulnerability/wordpress-disable-comments-for-any-post-types-remove-comments-plugin-1-3-0-broken-authentication-vulnerability?_s_id=cve) and the WordPress.org plugin page for a release above 1.3.0 and upgrade as soon as one is published. As compensating controls until then: because exploitation requires a low-privilege account (PR:L), tighten user registration and audit/limit existing low-privilege accounts to reduce the pool of potential attackers; restrict access to the plugin's recovery/AJAX/REST endpoints via a WAF or web-server rules (trade-off: rules must target the specific recovery path and may need tuning to avoid breaking legitimate password resets); and if the plugin is not essential, consider deactivating and removing it (trade-off: loss of comment-disabling functionality, which can usually be replaced by core WordPress discussion settings). Patchstack virtual patching (vPatch) may provide protection if you use that platform.