EUVD-2026-39371
GHSA-mrp6-98pf-fr62
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network endpoint with no interaction (AV:N/AC:L/PR:N/UI:N); missing authorization enables unauthorized state changes, so I:H while C and A are unaffected.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
AnalysisAI
Missing authorization in the CheckView Automated Testing WordPress plugin (versions 2.1.0 and earlier) lets remote unauthenticated attackers reach functionality that should be access-controlled, enabling unauthorized modification of site data or test/automation state. The CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N) reflects a network-reachable, no-interaction flaw with high integrity impact but no confidentiality or availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a target WordPress site has the CheckView Automated Testing plugin (version ≤ 2.1.0) installed and active, with its vulnerable endpoint reachable over the network - consistent with AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed against a default install. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are partially complete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates a WordPress site, identifies the CheckView plugin, and sends a crafted unauthenticated HTTP request directly to the plugin's unprotected action endpoint. Because no capability or nonce check is enforced, the request executes a state-changing operation, allowing the attacker to alter plugin or site data without any credentials. … |
| Remediation | No specific vendor-released patch version was provided in the input, so the actionable step is to upgrade to the latest CheckView release published after 2.1.0 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/checkview/vulnerability/wordpress-checkview-automated-testing-plugin-2-1-0-broken-access-control-vulnerability) or the WordPress plugin repository - do not rely on an assumed version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress instances running CheckView Automated Testing plugin version 2.1.0 or earlier and assess usage scope and criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today