EUVD-2026-62371
GHSA-8fqr-p5p2-jmcg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable unauthenticated endpoint with no complexity barrier; integrity-only impact from unauthorized privileged action; no scope change beyond the WordPress installation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.
AnalysisAI
Broken access control in the Stitch Express WordPress plugin (versions <= 1.9.0) allows unauthenticated network attackers to perform privileged operations by bypassing missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms zero-friction remote exploitation with high integrity impact, meaning unauthorized data modification or administrative action is achievable without credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication, elevated privileges, or user interaction are required - the CVSS vector PR:N/UI:N/AC:L explicitly confirms unauthenticated, zero-complexity, zero-interaction exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (High) accurately reflects the low-friction exploitation profile: network-reachable, no authentication, no user interaction, and low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker performs passive WordPress plugin enumeration against a target site by fetching the Stitch Express readme.txt file, confirming the installed version is <= 1.9.0. The attacker then sends a crafted unauthenticated HTTP request directly to the plugin's unprotected AJAX handler or REST API endpoint, bypassing the absent authorization check. … |
| Remediation | Update the Stitch Express WordPress plugin to a version beyond 1.9.0 if one has been released by the plugin developer; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/stitch-express/vulnerability/wordpress-stitch-express-plugin-1-9-0-broken-access-control-vulnerability for the confirmed fix version, as a specific patched version number was not independently confirmed from the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running Stitch Express plugin versions 1.9.0 or lower using plugin audit logs and filesystem scans; immediately disable and remove the plugin from all affected systems to eliminate the attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today