What is the CVSS score of EUVD-2026-37468?

EUVD-2026-37468 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-37468?

Yes, a patch is available for EUVD-2026-37468. Update the affected software to the latest version immediately.

WPAMS WordPress Plugin EUVD-2026-37468

Q: Which versions of WPAMS WordPress Plugin are affected by EUVD-2026-37468?

Arbitrary content deletion in the WPAMS WordPress plugin (versions prior to 49.5.3) by Mojoomla allows any authenticated subscriber-level user to delete content they are not authorized to remove.. A patch is available.

| CVE-2026-39433 MEDIUM

Missing Authorization (CWE-862)

2026-06-16 Patchstack

WordPress Authentication Bypass Wordpress Plugin Wpams Mojoomla

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible WordPress plugin requiring only subscriber authentication (PR:L); deletion-only impact maps solely to availability (A:H), with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:31 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.

AnalysisAI

Arbitrary content deletion in the WPAMS WordPress plugin (versions prior to 49.5.3) by Mojoomla allows any authenticated subscriber-level user to delete content they are not authorized to remove. Rooted in a missing authorization check (CWE-862), this flaw bypasses WordPress capability controls entirely for deletion operations. No active exploitation has been identified in CISA KEV, and no public proof-of-concept has been disclosed at time of analysis, but the low privilege bar - a standard subscriber account - makes exploitation trivially accessible to any registered site user.

Technical ContextAI

WPAMS is a WordPress plugin developed by Mojoomla for apartment and property management workflows, identified by CPE cpe:2.3:a:mojoomla:wpams:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), meaning the plugin performs content deletion operations without first verifying that the requesting user holds sufficient WordPress capabilities (e.g., 'delete_posts' or a custom role check). WordPress plugins are expected to validate nonces and capability checks on all privileged AJAX actions or REST endpoints; the absence of these checks allows a low-privilege subscriber role - the lowest authenticated role in a default WordPress installation - to trigger deletion of content objects that should be restricted to editors, administrators, or content owners.

RemediationAI

Upgrade WPAMS to version 49.5.3 or later, which contains the vendor-released patch per Patchstack advisory and EUVD-2026-37468. The patch is available directly through the WordPress plugin repository or via the WordPress admin dashboard update mechanism. As a compensating control prior to patching, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent unknown parties from obtaining subscriber accounts, though this does not address existing registered users. Alternatively, restrict WPAMS-related capabilities to trusted roles only and audit current subscriber accounts for unexpected registrations. Note that disabling registration may impact legitimate workflows if the site relies on self-service tenant or applicant registration through WPAMS.