What is the CVSS score of EUVD-2026-53962?

EUVD-2026-53962 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of BOX NOW Delivery Croatia are affected by EUVD-2026-53962?

The BOX NOW Delivery Croatia WordPress plugin contains an unauthenticated access control vulnerability that exposes sensitive business data to any internet-connected attacker without requiring…

How to fix or mitigate EUVD-2026-53962?

Within 24 hours, immediately disable and remove the BOX NOW Delivery Croatia plugin from all WordPress installations running version 3.3.0 or earlier; begin detailed access log analysis to identify any exploitation indicators correlated with CVE-2026-65504. Within 7 days, complete forensic data access audit to determine what sensitive information may have been exposed during the vulnerability window, verify backup integrity, and notify affected stakeholders. Within 30 days, procure and deploy a vendor-supported delivery plugin replacement with current security patching, implement Web Application Firewall rules blocking requests to the old plugin endpoints as backup mitigation if transition is delayed, and establish quarterly plugin security assessment cadence to prevent recurrence.

BOX NOW Delivery Croatia EUVD-2026-53962

| CVE-2026-65504 HIGH

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-ffpf-wgph-c46w

WordPress Authentication Bypass Wordpress Plugin Box Now Delivery Croatia

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable endpoint with no auth (PR:N), no complexity (AC:L), confidentiality-only impact; no integrity or availability effect described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:25 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

AnalysisAI

Broken access control in the BOX NOW Delivery Croatia WordPress plugin (versions <= 3.3.0) allows unauthenticated remote attackers to access restricted plugin functionality due to missing authorization checks, exposing sensitive data with high confidentiality impact. Reported by Patchstack and tracked under EUVD-2026-53962, this flaw is exploitable over the network with no credentials or user interaction required, making it trivially accessible to any attacker who can reach a vulnerable WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has the appropriate permission before executing sensitive operations or returning restricted data. The affected product is a WordPress delivery integration plugin authored by ivanbebek (CPE: cpe:2.3:a:ivanbebek:box_now_delivery_croatia:*:*:*:*:*:*:*:*), designed to integrate BOX NOW parcel locker delivery services for Croatian e-commerce sites built on WordPress/WooCommerce. WordPress plugins expose PHP-backed AJAX handlers and REST API endpoints; when these endpoints lack capability checks (e.g., current_user_can() or WordPress nonce verification tied to a role), any HTTP client - authenticated or not - can invoke them directly, constituting a broken access control condition.

RemediationAI

Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/box-now-delivery-croatia/vulnerability/wordpress-box-now-delivery-croatia-plugin-3-3-0-broken-access-control-vulnerability for patch availability and the confirmed fixed version; no specific patched release version was present in the available intelligence data, so 'Upstream fix available (PR/commit); released patched version not independently confirmed' is the current patch status. If a patched version is available in the WordPress plugin repository, update immediately via the WordPress dashboard or WP-CLI. If no patch is yet available, the most effective compensating control is to deactivate and remove the plugin until a fix is confirmed - this eliminates the attack surface entirely at the cost of losing BOX NOW delivery functionality. As a secondary measure, site operators can restrict access to WordPress AJAX and REST API endpoints via server-level rules (nginx location blocks or Apache mod_rewrite) to trusted IP ranges, though this may break legitimate plugin functionality for customers.