EUVD-2026-60909
GHSA-c29c-m7wj-f57r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exploitable with no authentication or interaction required; confidentiality-only impact consistent with information disclosure via CWE-288 authentication bypass.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.
AnalysisAI
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication, privileges, or user interaction are required - the CVSS vector (PR:N, UI:N, AC:L, AV:N) confirms this is exploitable by any unauthenticated remote attacker over the network against a default installation of the plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (High) is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), no privileges or interaction required (PR:N/UI:N), with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running the Ezoic plugin version ≤ 2.22.11 and sends a crafted HTTP request directly to the vulnerable endpoint, bypassing the plugin's authentication check via an alternate code path. The server responds with sensitive data - potentially including API keys, plugin configuration, or site-specific publisher credentials - without requiring any valid session or WordPress login. … |
| Remediation | Update the Ezoic WordPress plugin to a version above 2.22.11 as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances running Ezoic plugin version 2.22.11 or earlier and document which systems are internet-facing. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows an
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. Rated
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today