What is the CVSS score of EUVD-2026-39749?

EUVD-2026-39749 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

WCBoost Products Compare EUVD-2026-39749

Q: Which versions of WCBoost Products Compare are affected by EUVD-2026-39749?

Unauthenticated sensitive data exposure in the WCBoost - Products Compare WordPress plugin (versions <= 1.1.0) allows any remote attacker to access sensitive information without credentials.

| CVE-2026-57633 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-06-26 audit@patchstack.com

GHSA-9cp8-fxmh-4hc3

WordPress Information Disclosure Wordpress Plugin

5.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible, zero-auth exposure (PR:N, AV:N); limited partial confidentiality loss only; no integrity or availability impact confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:13 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the WCBoost - Products Compare WordPress plugin (versions <= 1.1.0) allows any remote attacker to access sensitive information without credentials. The CVSS vector confirms network-accessible exploitation requiring no authentication, no user interaction, and low complexity, yielding a partial confidentiality breach. No public exploit code or active exploitation has been identified at time of analysis, though the zero-barrier entry point makes opportunistic scanning trivial.

Technical ContextAI

WCBoost - Products Compare is a WooCommerce-focused WordPress plugin enabling front-end product comparison functionality. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes the root cause: the plugin exposes data that should be restricted - such as internal product metadata, configuration state, or user-related comparison data - through an endpoint or response path accessible without authentication. This class of vulnerability typically arises when REST API endpoints, AJAX handlers, or shortcode outputs omit capability checks, inadvertently surfacing data to anonymous requests. The affected version range is WCBoost - Products Compare n/a through 1.1.0, as identified by the ENISA EUVD-2026-39749 record and Patchstack audit.

RemediationAI

The primary remediation is to update the WCBoost - Products Compare plugin to a version above 1.1.0 via the WordPress admin dashboard or WP-CLI. The exact patched version was not specified in the available intelligence - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wcboost-products-compare/vulnerability/wordpress-wcboost-8211-products-compare-plugin-1-1-0-sensitive-data-exposure-vulnerability for the confirmed fix version before upgrading. If an immediate update is not possible, a compensating control is to disable or deactivate the plugin until a patch is applied - this eliminates the attack surface entirely at the cost of losing product comparison functionality. Alternatively, a WAF rule blocking unauthenticated requests to the plugin's AJAX or REST endpoints can reduce exposure, though the specific endpoint path would need to be identified from the plugin source code.