What is the CVSS score of EUVD-2026-48109?

EUVD-2026-48109 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Complianz EUVD-2026-48109

| CVE-2026-65498 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-23 Patchstack

GHSA-fw7w-9h9q-259h

WordPress Information Disclosure Complianz Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint requires no authentication (PR:N) and no user interaction; confidentiality impact is limited (C:L) with no integrity or availability effect confirmed from available data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:18 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.

Technical ContextAI

Complianz is a WordPress plugin designed to help site owners achieve GDPR, CCPA, and cookie consent compliance. It processes and stores sensitive compliance-related data, potentially including visitor consent records, personal data processing configurations, and site-specific legal settings. CWE-497 describes a class of vulnerabilities where an application returns sensitive internal or system data in responses accessible to unauthorized parties - typically due to missing or improperly enforced access controls on API endpoints, REST routes, or admin-ajax handlers. The CPE string cpe:2.3:a:complianz:complianz:*:*:*:*:*:*:*:* covers all platform variants of the plugin up to 7.5.0, indicating the flaw is in core plugin logic rather than a platform-specific integration.

RemediationAI

Update the Complianz plugin to a version beyond 7.5.0 as soon as a patched release is confirmed - no exact fixed version was identified in the available intelligence, so the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/complianz-gdpr/vulnerability/wordpress-complianz-plugin-7-5-0-sensitive-data-exposure-vulnerability?_s_id=cve should be monitored for the confirmed fix version, and the WordPress plugin repository should be checked for the latest available release. As a compensating control pending a patch, administrators can implement server-level access restrictions (via Apache .htaccess directives or nginx location blocks) targeting the specific plugin REST API routes or admin-ajax endpoints returning sensitive data, though this may degrade plugin functionality such as consent banner operation or compliance reporting. A WAF rule filtering responses that include recognizable compliance data fields can reduce exposure risk without requiring application changes. These controls are temporary mitigations only and do not address the root cause.