What is the CVSS score of EUVD-2026-55261?

EUVD-2026-55261 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

WP Umbrella EUVD-2026-55261

| CVE-2026-66642 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-10 Patchstack

GHSA-x59x-hvff-fx38

WordPress CSRF Wordpress Plugin Wp Umbrella

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Attacker needs no privileges (PR:N); victim interaction is mandatory (UI:R); integrity and availability impacts are low with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 11:01 vuln.today

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery.

This issue affects WP Umbrella: from n/a through 2.26.2.

AnalysisAI

Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

WP Umbrella is a WordPress site management and monitoring plugin, identified by CPE cpe:2.3:a:wp_umbrella:wp_umbrella:*:*:*:*:*:*:*:*. The root cause is CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to validate that state-changing HTTP requests originate from the legitimate WordPress admin interface rather than a third-party attacker-controlled origin. In WordPress, CSRF protections are typically implemented via nonces (single-use tokens embedded in forms and AJAX requests); absence or improper verification of these nonces on one or more plugin endpoints allows forged requests submitted by the victim's browser to execute with the victim's authenticated session privileges. The vulnerability was discovered and reported by Patchstack, a WordPress-specific security intelligence platform.

RemediationAI

Update the WP Umbrella plugin to a version beyond 2.26.2 as soon as one is available from the WordPress plugin repository or the vendor. No exact patched release version is independently confirmed in the available data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-health/vulnerability/wordpress-wp-umbrella-plugin-2-26-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve should be monitored for a confirmed fix version. As a compensating control pending a patch, administrators can reduce exposure by avoiding accessing the WordPress admin dashboard while browsing untrusted external sites, and by using separate browser profiles for administrative sessions. A web application firewall with CSRF detection rules (such as those offered by Patchstack Shield or Wordfence) can add an additional layer of protection, though nonce-bypass via WAF is not guaranteed. Restricting admin access by IP at the server or hosting level reduces the attack surface further with minimal operational trade-off.