What is the CVSS score of EUVD-2026-37610?

EUVD-2026-37610 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

WPBakery Page Builder EUVD-2026-37610

Q: Which versions of WPBakery Page Builder are affected by EUVD-2026-37610?

Broken access control in WPBakery Page Builder (versions ≤ 8.7.2) allows subscriber-level authenticated WordPress users to invoke privileged functionality without proper authorization checks.

| CVE-2026-45436 MEDIUM

Missing Authorization (CWE-862)

2026-06-17 Patchstack

WordPress Authentication Bypass Wordpress Plugin Wpbakery Page Builder WPBakery Page Builder

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Subscriber-level account required (PR:L); network-exploitable with no complexity (AV:N/AC:L); high integrity impact from unauthorized writes; no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:52 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.

AnalysisAI

Broken access control in WPBakery Page Builder (versions ≤ 8.7.2) allows subscriber-level authenticated WordPress users to invoke privileged functionality without proper authorization checks. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms this is network-exploitable with low complexity and high integrity impact, meaning authenticated low-privilege users can perform content or administrative actions restricted to higher roles such as editor or administrator. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but WPBakery Page Builder's broad WordPress deployment footprint makes this a real remediation priority for sites with open user registration.

Technical ContextAI

WPBakery Page Builder (formerly Visual Composer), developed by Rain-Task Ltd., is one of the most widely deployed WordPress page builder plugins, identified by CPE cpe:2.3:a:rain-task_ltd.:wpbakery_page_builder:*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) is the root cause class, indicating that one or more plugin endpoints or AJAX actions fail to call or correctly evaluate WordPress capability checks (e.g., current_user_can()) before executing privileged operations. In WordPress's role model, Subscribers are the lowest authenticated tier, with essentially read-only permissions; any functionality they can reach that modifies content or settings represents a privilege escalation through missing authorization logic. The vulnerability was reported by Patchstack, whose platform specializes in WordPress plugin security research.

RemediationAI

Update WPBakery Page Builder to a version above 8.7.2 per the vendor release. The exact patched version must be confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/js_composer/vulnerability/wordpress-wpbakery-page-builder-plugin-8-7-2-broken-access-control-vulnerability?_s_id=cve or the official WordPress plugin repository, as no specific fix version was confirmed in the available data. As a compensating control pending patch deployment, disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent external attackers from self-provisioning the required subscriber account; note this will break any registration-dependent workflows. For sites that must allow registration, use a role management plugin to strip subscriber-role access to WPBakery-related capabilities, or restrict the plugin's AJAX endpoints at the web application firewall level - though this may degrade page builder functionality for legitimate editors.