EUVD-2026-60909
GHSA-c29c-m7wj-f57r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Ezoic plugin ≤ 2.22.11
-
ExploitSend unauthenticated HTTP request to bypass endpoint
-
ExecutionAlternate code path skips authentication gate (CWE-288)
-
ImpactExtract sensitive plugin or site configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | No authentication, privileges, or user interaction are required - the CVSS vector (PR:N, UI:N, AC:L, AV:N) confirms this is exploitable by any unauthenticated remote attacker over the network against a default installation of the plugin. The Ezoic plugin must be installed and active on the WordPress site, and the site must be running plugin version 2.22.11 or earlier. No non-default WordPress configuration is implied as a prerequisite. Exploitation is bounded to confidentiality impact only (I:N, A:N) - an attacker cannot modify content or disrupt site availability through this vector alone. The specific endpoint or handler containing the authentication bypass is not disclosed in available public intelligence, which currently limits mass automated exploitation. |
| Impact | The CVSS 3.1 score of 7.5 (High) is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), no privileges or interaction required (PR:N/UI:N), with high confidentiality impact. These metrics are internally consistent with a CWE-288 bypass exposing sensitive data to anonymous HTTP requesters. The scope is unchanged (S:U), limiting blast radius to the affected component rather than the broader WordPress host. No EPSS score is provided in the available intelligence, making probabilistic exploitation likelihood assessment impossible from this dataset. No KEV listing and no POC are referenced, so exploitation status is currently unconfirmed. Given that Ezoic is used by a meaningful population of publishing-focused WordPress sites, the attack surface is real, but the lack of active exploitation signals and the read-only (C:H, I:N, A:N) impact profile suggest this is a genuine high-priority patch target rather than an emergency incident-response trigger. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running the Ezoic plugin version ≤ 2.22.11 and sends a crafted HTTP request directly to the vulnerable endpoint, bypassing the plugin's authentication check via an alternate code path. The server responds with sensitive data - potentially including API keys, plugin configuration, or site-specific publisher credentials - without requiring any valid session or WordPress login. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and zero-credential requirement suggest a straightforward exploit once the endpoint is mapped. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. No public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Update the Ezoic WordPress plugin to a version above 2.22.11 as the primary fix. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ezoic-integration/vulnerability/wordpress-ezoic-plugin-2-22-11-broken-authentication-vulnerability should be consulted for the confirmed patched release version, as no exact fix version number is independently verifiable from the available data. As a temporary compensating control, site administrators may deactivate the Ezoic plugin entirely until an upgrade is confirmed - this eliminates the attack surface at the trade-off of disabling monetization and performance features. Restricting access to the WordPress AJAX or REST API endpoints via WAF rules or server-level ACLs may reduce exposure but cannot be precisely scoped without knowing the specific vulnerable endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Ezoic plugin (CPE: cpe:2.3:a:ezoic:ezoic:*:*:*:*:*:*:*:*) is a widely used WordPress integration for publisher monetization, ad optimization, and site performance tooling. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates that one or more plugin endpoints - likely a WordPress REST API route, AJAX handler, or third-party callback - omits proper capability checks or nonce verification, allowing requests to reach privileged functionality without going through WordPress's standard authentication gate. This is distinct from credential-stuffing or brute-force weaknesses; the bypass exists structurally in the code path itself. The high confidentiality impact and absence of integrity or availability impact suggest the vulnerable endpoint exposes sensitive read-only data, such as plugin configuration, API credentials, or subscriber metadata.
Know when Ezoic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exploitable with no authentication or interaction required; confidentiality-only impact consistent with information disclosure via CWE-288 authentication bypass.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.
Executive ViewAI
The Ezoic WordPress plugin (versions 2.22.11 and earlier) contains an unauthenticated authentication bypass that enables remote attackers to access sensitive site data without credentials. All organizations running this plugin face potential information disclosure, with no patch currently available from the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) deactivate the Ezoic plugin in WordPress admin if functionality is dispensable; (2) implement Web Application Firewall rules to restrict unauthenticated requests to administrative and sensitive API endpoints; (3) configure comprehensive audit logging to capture and alert on authentication bypass attempts; (4) apply network-level IP allowlisting to WordPress admin interfaces where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows an
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. Rated
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Exploit-DB