What is the CVSS score of EUVD-2026-39764?

EUVD-2026-39764 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Shoppable Images Lite EUVD-2026-39764

| CVE-2026-57649 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-5p8m-h8vr-j4rc

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable WordPress endpoint (AV:N), trivial to exploit (AC:L), subscriber account required (PR:L); only limited read-only data exposure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:10 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

AnalysisAI

Broken access control in the Shoppable Images Lite WordPress plugin (versions 1.3 and below) allows subscriber-level authenticated users to perform actions or access data beyond their authorized scope. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether the requesting user holds sufficient privileges before executing restricted functionality. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; real-world risk is tempered by the authentication prerequisite and the plugin's limited deployment footprint.

Technical ContextAI

Shoppable Images Lite is a WordPress plugin that enables merchants to create interactive, clickable product images. CWE-862 (Missing Authorization) indicates that specific plugin endpoints or AJAX handlers do not perform a capability or nonce check commensurate with the operation's sensitivity, allowing any authenticated WordPress user - even those with the minimal 'subscriber' role - to invoke them. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms the flaw is remotely exploitable over HTTP/HTTPS with low complexity, requires only low-privilege credentials, and produces a limited confidentiality impact with no integrity or availability degradation. The affected CPE is inferred from the Patchstack advisory as the WordPress plugin mabel-shoppable-images-lite at versions up to and including 1.3.

RemediationAI

Upstream fix availability is not independently confirmed from the provided data - no exact patched version number was included in the advisory reference. Site administrators should check the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mabel-shoppable-images-lite/vulnerability/wordpress-shoppable-images-lite-plugin-1-3-broken-access-control-vulnerability) for an updated release beyond 1.3. If no patch is yet available, a compensating control is to deactivate the plugin until a fix is released, accepting the loss of shoppable-image functionality. Alternatively, if the site does not require open subscriber registration, disabling public user registration (Settings > General > Membership in WordPress) removes the attacker's ability to obtain the required low-privilege account, effectively blocking the exploitation path without disabling the plugin.