Ezoic WordPress Plugin EUVD-2026-57102

No special conditions - remote unauthenticated exploitation against any WordPress installation running the Ezoic plugin in versions 2.6.35 through before 2.23.1 with default configuration. The vulnerable endpoint is exposed whenever the plugin is active; no specific feature toggle, non-default setting, or server configuration is required. The sole limiting factor is the presence of the Ezoic plugin: WordPress sites that do not have Ezoic installed or have it deactivated are entirely unaffected. Plugin activity status is the only prerequisite.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly identifies trivial remote unauthenticated exploitation, but the integrity rating of I:N understates real-world impact: the description explicitly confirms that attackers can persistently alter plugin settings, implying at minimum I:L. This inconsistency should be verified against the vendor advisory. No EPSS score or CISA KEV listing is present in the input data, meaning exploitation probability and confirmed in-the-wild abuse cannot be quantified from available signals - however, the existence of a publicly available exploit (reported by WPScan) materially elevates the operational risk above what the CVSS score alone suggests. The combination of PR:N + AC:L + publicly available exploit means exploitation is automatable and scalable across any internet-facing WordPress site with the plugin active. The exposure of password reset tokens is particularly severe because it enables immediate authenticated sessions without any credential cracking, bypassing the usual time cost of hash exploitation.

An attacker scans for WordPress installations with the Ezoic plugin via HTTP fingerprinting or by checking plugin asset paths, then sends a crafted unauthenticated POST request to the vulnerable export endpoint. The server returns a database dump containing all user records including password hashes and any active reset tokens; the attacker uses a valid reset token to immediately authenticate as a WordPress administrator without cracking any passwords. A publicly available exploit exists per WPScan, making this scenario straightforward to execute at scale.