What is the CVSS score of EUVD-2026-62386?

EUVD-2026-62386 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Outranking Plugin Options are affected by EUVD-2026-62386?

The Outranking Plugin Options WordPress plugin (versions 1.1.3 and below) contains an unauthenticated access control vulnerability that enables remote attackers to modify plugin configuration without…

How to fix or mitigate EUVD-2026-62386?

Within 24 hours, conduct an inventory of WordPress installations using the Outranking Plugin Options plugin and immediately disable or remove the vulnerable plugin. Within 7 days, audit all plugin option modifications and WordPress site configuration changes occurring prior to remediation to identify any unauthorized alterations made through this vulnerability. Within 30 days, monitor the vendor's advisory channel for a security patch release; when available, update to the patched version (currently not released as of analysis). Simultaneously deploy compensating controls including WAF rules blocking unauthorized plugin option modifications, network segmentation restricting plugin access, and integrity monitoring on critical WordPress configuration files.

Outranking Plugin Options EUVD-2026-62386

| CVE-2026-73385 HIGH

Missing Authorization (CWE-862)

2026-08-19 Patchstack

GHSA-cp7m-84q4-9j2r

Authentication Bypass Outranking Plugin Options

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-accessible WordPress endpoint with no auth required; integrity-only impact aligns with option-write primitive; no confidentiality or availability effect identified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 13:24 vuln.today

CVE Published

Aug 19, 2026 - 12:38 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

AnalysisAI

Unauthenticated broken access control in the Outranking Plugin Options WordPress plugin (versions 1.1.3 and below) allows remote unauthenticated attackers to modify plugin options, resulting in high integrity impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has permission before processing option-change requests. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site via fingerprinting

Delivery

Confirm Outranking plugin version ≤ 1.1.3

Exploit

Send unauthenticated HTTP request to unprotected endpoint

Execution

Bypass missing authorization check

Impact

Overwrite plugin options with attacker-controlled values

Access

Identify WordPress site via fingerprinting

Delivery

Confirm Outranking plugin version ≤ 1.1.3

Exploit

Send unauthenticated HTTP request to unprotected endpoint

Execution

Bypass missing authorization check

Impact

Overwrite plugin options with attacker-controlled values

Vulnerability AssessmentAI

Exploitation	No special authentication is required - the CVSS vector PR:N and UI:N confirm that the affected endpoint(s) are reachable by any unauthenticated HTTP client against a default WordPress installation running this plugin. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a genuinely accessible flaw: no authentication, no complexity, and reachable over the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker identifies a WordPress site running Outranking Plugin Options 1.1.3 or earlier, likely via mass scanning or WordPress-specific fingerprinting. The attacker sends a crafted HTTP POST request to the plugin's unprotected AJAX or REST endpoint - requiring no credentials or session token - and overwrites plugin option values, potentially injecting malicious content or altering SEO-related configuration. …
Remediation	Update the Outranking Plugin Options plugin to a version higher than 1.1.3 once a patched release is confirmed available via the WordPress plugin repository or the vendor. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct an inventory of WordPress installations using the Outranking Plugin Options plugin and immediately disable or remove the vulnerable plugin. …

Threat intelligence, references, and detailed analysis are available after sign-in.