Qubely EUVD-2026-48132

Exploitation requires no authentication (PR:N per CVSS vector), but high attack complexity (AC:H) means a specific, non-default condition must be met - likely knowledge of the exact vulnerable endpoint or parameter within the Qubely plugin. The plugin must be installed and active on the target WordPress site. The Patchstack description does not specify whether a particular Qubely feature (e.g., block templates, font loader, Google Fonts API proxy) must be enabled, so the precise triggering configuration is unconfirmed from available data. Exploitation is limited by: the AC:H constraint implying a non-trivial exploitation path, low impact ceiling (C:L/I:L, no availability impact), and the requirement that Qubely be actively installed - sites not using this plugin are entirely unaffected.

The CVSS 3.1 base score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N reflects a genuinely moderate risk profile. Network accessibility without authentication (AV:N, PR:N, UI:N) broadens the attack surface, but high attack complexity (AC:H) substantially limits opportunistic exploitation - automated mass scanning is unlikely to succeed without additional preconditions. Impact is bounded: confidentiality and integrity are both rated Low, with no availability impact, suggesting the reachable functionality does not touch critical content or settings. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no POC code is referenced. Patchstack is the sole reporting source; no independent vendor advisory or NVD enrichment is available. Overall, this is a real but low-urgency issue - highest priority for sites where Qubely is installed and exposed to untrusted networks, lowest for sites behind authentication proxies or WAFs.

An unauthenticated attacker identifies a WordPress site running Qubely 1.8.14 or earlier and sends a crafted HTTP request - likely a POST to a specific wp-ajax or REST API endpoint - without providing valid authentication credentials. The missing authorization check allows the request to be processed, enabling the attacker to read limited data or modify certain plugin-managed content. Because AC:H applies, the attacker likely needs prior knowledge of the specific endpoint and parameters, reducing the practicality of automated mass exploitation. No public POC has been identified at time of analysis.