What is the CVSS score of EUVD-2026-39678?

EUVD-2026-39678 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Object Cache 4 everyone are affected by EUVD-2026-39678?

The Object Cache 4 Everyone WordPress plugin (versions 2.3.2 and earlier) contains a critical vulnerability allowing unauthorized external parties to access sensitive cached application data without…

How to fix or mitigate EUVD-2026-39678?

Within 24 hours: Audit all WordPress instances for Object Cache 4 Everyone ≤2.3.2; document what sensitive data may be cached. Within 7 days: Restrict network access to cache layer to internal systems only; clear sensitive data from cache; disable the plugin if not business-critical. Within 30 days: Monitor Patchstack and vendor advisories for patch release; prepare staged upgrade procedure for immediate deployment upon patch availability.

Object Cache 4 everyone EUVD-2026-39678

| CVE-2026-54834 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-26 audit@patchstack.com

GHSA-3pf2-chrh-rq92

WordPress Information Disclosure Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity, unauthenticated disclosure with no user interaction (PR:N/UI:N) yielding confidentiality-only impact (C:H, I:N/A:N), consistent with CWE-201 information exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:35 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

AnalysisAI

Sensitive data exposure in the WordPress plugin Object Cache 4 everyone (versions 2.3.2 and earlier) lets remote unauthenticated attackers retrieve information the application intended to keep private, per the Patchstack advisory and a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact). The flaw, classed as CWE-201, stems from the caching layer inadvertently exposing sensitive cached content to unauthorized requestors. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Object Cache 4 everyone is a WordPress persistent object-cache plugin that stores the results of expensive database queries and rendered objects to speed up page delivery. The vulnerability maps to CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the cache or its supporting endpoints emit data - potentially cached query results, internal objects, or configuration values - into responses reachable by unauthenticated clients. Because object caches frequently hold authenticated-session-derived or backend data, improper access controls around the cache surface can expose information never intended for anonymous visitors. No CPE strings were supplied in the input; the affected component is identified by plugin slug 'object-cache-4-everyone' rather than a formal CPE.

RemediationAI

No vendor-released patch version is identified in the provided data, though the '<= 2.3.2' framing implies a fixed release likely exists in the plugin's later versions - administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/object-cache-4-everyone/vulnerability/wordpress-object-cache-4-everyone-plugin-2-3-2-sensitive-data-exposure-vulnerability?_s_id=cve) and the WordPress.org plugin page to confirm and upgrade to the first patched release above 2.3.2. As compensating controls until patched, restrict or block unauthenticated access to any plugin-exposed cache endpoints at the web server or WAF layer (Patchstack offers virtual patching for this CVE), and if the plugin is not essential, deactivate and remove it - trading the caching performance benefit for closure of the exposure. Review web/access logs for anomalous requests to cache-related paths to gauge prior exposure.