What is the CVSS score of EUVD-2026-50966?

EUVD-2026-50966 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of FleekDash V2 are affected by EUVD-2026-50966?

The FleekDash V2 WordPress plugin contains a critical account takeover vulnerability affecting all installations running versions 2.6.2.2 and earlier, allowing unauthenticated attackers to seize…

How to fix or mitigate EUVD-2026-50966?

Within 24 hours, inventory all WordPress installations running FleekDash V2 versions ≤ 2.6.2.2 and escalate to the responsible teams. Within 7 days, completely remove the FleekDash V2 plugin from all affected sites, or if operationally critical, deploy web application firewall rules to block all requests to the /wp-json/fleekdash/v1/register endpoint and conduct a forensic audit of administrator and Subscriber account modification logs for unauthorized changes. Within 30 days, evaluate alternative WordPress plugins to replace FleekDash V2 functionality, implement alerting on all user account modifications, and establish a vendor patch monitoring process for future FleekDash vulnerabilities.

FleekDash V2 EUVD-2026-50966

| CVE-2026-14356 HIGH

Missing Authorization (CWE-862)

2026-07-30 Wordfence

GHSA-5cfw-whc5-jqgh

WordPress Authentication Bypass Wordpress Plugin Fleekdash V2

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Self-registration endpoint dispenses the required account and nonce, so exploitation is effectively unauthenticated (PR:N); network vector and low complexity yield full C/I/A takeover.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 04:53 vuln.today

CVE Published

Jul 30, 2026 - 04:03 cve.org

HIGH 8.8

DescriptionCVE.org

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any WordPress user, including administrators, enabling full account takeover and complete site compromise. The public /wp-json/fleekdash/v1/register endpoint auto-provisions a Subscriber-role account and returns a valid REST nonce regardless of the site's users_can_register setting, enabling unauthenticated attackers to self-provision the required credentials and nonce in a single prior request.

AnalysisAI

Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (cpe:2.3:a:fleekdash:fleekdash_v2) that exposes functionality through the WordPress REST API. The root cause is CWE-862 (Missing Authorization): a user-mutating action in UserController.php does not verify that the caller is permitted to modify the targeted account, so it accepts a target user identifier and applies email/password changes without a capability or ownership check. WordPress REST endpoints normally gate write actions behind both a nonce and a permission_callback; here the nonce is satisfied (and even freely dispensed by the register endpoint) while the authorization layer is effectively absent. The self-registration path compounds this by ignoring the standard users_can_register safeguard, meaning the site's own registration policy provides no protection.

RemediationAI

No vendor-released patch identified at time of analysis, so update to any release later than 2.6.2.2 as soon as the vendor publishes one and monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0867f6a6-17f6-48d3-8ef2-bf89f5b28b05?source=cve) for the fixed version. As an immediate compensating control, deactivate and remove the FleekDash V2 plugin until a fix is available - this removes the vulnerable endpoint entirely at the cost of losing the plugin's functionality. If the plugin must stay active, block or restrict access to the /wp-json/fleekdash/v1/register and account-modification endpoints at a WAF or reverse proxy (Wordfence's own firewall rules may cover this), noting that overly broad REST API blocking can break legitimate site or plugin features. Additionally, audit existing users for unexpected Subscriber accounts and unexplained email/password changes on administrator accounts, and rotate admin credentials if any tampering is suspected.