What is the CVSS score of EUVD-2026-39738?

EUVD-2026-39738 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

SEOPress PRO EUVD-2026-39738

| CVE-2026-57430 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-vh94-rj7h-rpp2

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable WordPress endpoint requires low-privilege Contributor login; no confidentiality or availability impact, only limited integrity modification.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:17 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

AnalysisAI

Broken Access Control in SEOPress PRO WordPress plugin versions up to and including 9.1.1 allows authenticated users holding the Contributor role to perform privileged actions beyond their intended authorization scope. Exploitation requires a valid WordPress account with at least Contributor-level access, making this an insider or low-privilege escalation risk rather than a remote unauthenticated threat. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low attack complexity and network reachability keep this a realistic risk in multi-author WordPress environments.

Technical ContextAI

SEOPress PRO is a premium WordPress SEO plugin handling metadata, sitemaps, redirects, and structured data for WordPress sites. The vulnerability is classified under CWE-862 (Missing Authorization), indicating that the plugin fails to verify whether the requesting user has sufficient permissions before executing one or more privileged operations - a common pattern in WordPress plugins where REST API endpoints or AJAX handlers omit capability checks. The CVSS vector (PR:L) confirms exploitation requires a low-privilege authenticated session, consistent with WordPress Contributor role abuse. The affected CPE corresponds to SEOPress PRO versions up to and including 9.1.1, as reported via the Patchstack vulnerability database (EUVD-2026-39738).

RemediationAI

The primary remediation is to update SEOPress PRO to a version beyond 9.1.1; however, no specific patched release version was confirmed in the available source data - the fix version should be verified directly via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-seopress-pro/vulnerability/wordpress-seopress-pro-plugin-9-1-1-broken-access-control-vulnerability or the official SEOPress changelog. As a compensating control prior to patching, site administrators should audit and restrict the Contributor role - specifically, avoid assigning Contributor accounts to untrusted or external users until the patch is applied. Disabling the SEOPress PRO plugin entirely is a high-impact workaround that eliminates the attack surface but also removes all SEO functionality. No other specific workarounds were identified in the available intelligence.