What is the CVSS score of EUVD-2026-48130?

EUVD-2026-48130 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Graphina EUVD-2026-48130

| CVE-2026-65529 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-w2x3-w5vp-73gh

WordPress Authentication Bypass Wordpress Plugin Graphina Iqonic Design

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network-reachable endpoint with no complexity; confidentiality-only impact as no write or disruption capability is indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:11 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.

AnalysisAI

Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Graphina is a WordPress plugin by Iqonic Design that integrates with Elementor to render charts and graphs, identified by CPE cpe:2.3:a:iqonic_design:graphina:*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) describes a root cause where code reaches a sensitive operation - typically a REST API route or WordPress AJAX action - without first invoking an authorization check (e.g., current_user_can() or a capability check). In the WordPress plugin ecosystem this commonly manifests as registered AJAX handlers accessible via wp-admin/admin-ajax.php or REST endpoints that are publicly registered but lack nonce validation or role gating, permitting any network-reachable party to call them. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is fully reachable over the network with no authentication and no user interaction required, consistent with a publicly exposed WordPress endpoint.

RemediationAI

Update the Graphina plugin to a version beyond 3.1.12 via the WordPress plugin dashboard or manually from the WordPress plugin repository. Patch availability per vendor advisory is confirmed by Patchstack (https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-1-12-broken-access-control-vulnerability?_s_id=cve), though an exact fixed version number was not independently confirmed in the available input data - verify the current stable release in the WordPress plugin repository before deploying. If immediate patching is not possible, a compensating control is to audit and restrict access to the specific AJAX action or REST route involved using a Web Application Firewall (WAF) rule; however, identifying the precise endpoint requires code-level review of the affected plugin versions. Deactivating the plugin until patched eliminates the attack surface entirely at the cost of losing chart and graph functionality for site visitors.