What is the CVSS score of EUVD-2026-57893?

EUVD-2026-57893 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Vehica Core EUVD-2026-57893

| CVE-2026-66654 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-13 Patchstack

GHSA-jm29-w8w6-qv96

WordPress SSRF Wordpress Plugin Vehica Core Tangiblewp

6.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.0 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

6.0 MEDIUM

Network-reachable SSRF requiring subscriber auth (PR:L) and specific conditions (AC:H); scope change reflects potential internal host access beyond WordPress.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:13 vuln.today

DescriptionCVE.org

Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.

AnalysisAI

Server-Side Request Forgery in Vehica Core WordPress plugin (versions ≤ 1.0.104) allows an authenticated subscriber-level user to induce the server into making arbitrary HTTP requests to internal or external endpoints, potentially exposing internal network topology or services not intended to be reachable from the internet. The vulnerability carries a CVSS 3.1 score of 6.0 with a scope change (S:C), indicating that exploitation can affect systems beyond the vulnerable WordPress installation itself. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Vehica Core is a WordPress plugin developed by TangibleWP (CPE: cpe:2.3:a:tangiblewp:vehica_core:*:*:*:*:*:*:*:*) designed to support automotive or vehicle listing directory functionality. The root cause class is CWE-918 (Server-Side Request Forgery), in which user-controlled input is passed to a server-side HTTP request function without adequate validation or allowlisting of destination hosts or schemes. The CVSS vector specifies a Changed scope (S:C), meaning the forged requests can reach resources outside the security boundary of the WordPress application - such as cloud instance metadata endpoints (e.g., AWS IMDSv1), internal microservices, or other hosts on the server's private network segment. The AC:H metric indicates that exploitation is not straightforward and depends on specific preconditions being met within the application's request-handling logic.

RemediationAI

Update the Vehica Core plugin to a version beyond 1.0.104 as soon as a patched release is published by TangibleWP. Patch availability per vendor has not been independently confirmed at time of analysis - operators should monitor the plugin's WordPress repository page and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/vehica-core/vulnerability/wordpress-vehica-core-plugin-1-0-104-server-side-request-forgery-ssrf-vulnerability for release of a fixed version. As an interim compensating control, restrict subscriber-level account registration on the WordPress installation if it is not a business requirement, which eliminates the low-privilege attack surface entirely. If cloud-hosted, enforce IMDSv2 (token-required mode) on the instance to neutralize the most common SSRF lateral-movement target - note this only addresses cloud metadata exposure and not broader internal network probing. Additionally, consider deploying a web application firewall rule to block outbound server-initiated requests to RFC 1918 address ranges and cloud metadata IP addresses (169.254.169.254, fd00:ec2::254).