What is the CVSS score of EUVD-2026-39738?

EUVD-2026-39738 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

SEOPress PRO EUVD-2026-39738

| CVE-2026-57430 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-vh94-rj7h-rpp2

Authentication Bypass

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable WordPress endpoint requires low-privilege Contributor login; no confidentiality or availability impact, only limited integrity modification.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:17 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

AnalysisAI

Broken Access Control in SEOPress PRO WordPress plugin versions up to and including 9.1.1 allows authenticated users holding the Contributor role to perform privileged actions beyond their intended authorization scope. Exploitation requires a valid WordPress account with at least Contributor-level access, making this an insider or low-privilege escalation risk rather than a remote unauthenticated threat. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain WordPress Contributor credentials

Delivery

Identify unprotected SEOPress PRO AJAX/REST endpoint

Exploit

Send authenticated request without required capability

Execution

Bypass authorization check (CWE-862)

Impact

Modify privileged SEO settings or data

Access

Obtain WordPress Contributor credentials

Delivery

Identify unprotected SEOPress PRO AJAX/REST endpoint

Exploit

Send authenticated request without required capability

Execution

Bypass authorization check (CWE-862)

Impact

Modify privileged SEO settings or data

Vulnerability AssessmentAI

Exploitation	Exploitation requires an active WordPress user account with at least Contributor-level role on the target site - unauthenticated exploitation is not possible per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 4.3 (Medium) is consistent with the limited impact profile: integrity-only (I:L), no confidentiality or availability impact, unchanged scope, and a requirement for low-privilege authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a valid WordPress Contributor account on a target site sends a crafted authenticated request (REST API or AJAX) to a SEOPress PRO endpoint that lacks proper capability checks, invoking a privileged SEO management function - such as modifying redirect rules, metadata, or plugin settings - that should be restricted to Editor or Administrator roles. Because the plugin does not validate the caller's capabilities, the action succeeds, allowing the attacker to manipulate SEO configurations, potentially injecting malicious redirects or altering structured data. …
Remediation	The primary remediation is to update SEOPress PRO to a version beyond 9.1.1; however, no specific patched release version was confirmed in the available source data - the fix version should be verified directly via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-seopress-pro/vulnerability/wordpress-seopress-pro-plugin-9-1-1-broken-access-control-vulnerability or the official SEOPress changelog. … Detailed patch versions, workarounds, and compensating controls in full report.