Outranking Plugin Options EUVD-2026-62386

No special authentication is required - the CVSS vector PR:N and UI:N confirm that the affected endpoint(s) are reachable by any unauthenticated HTTP client against a default WordPress installation running this plugin. The limiting factor is installation scope: the target site must be running Outranking Plugin Options version 1.1.3 or below with the plugin active. There is no indication that a non-default configuration is required to expose the vulnerability. Exploitation is constrained to integrity impact on plugin options only; it does not provide code execution, credential access, or availability disruption based on available data.

The CVSS 3.1 score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a genuinely accessible flaw: no authentication, no complexity, and reachable over the network. The integrity impact is rated High while confidentiality and availability are unaffected, meaning exploitation primarily risks unauthorized modification of plugin settings rather than data exfiltration or service disruption. The real-world priority is moderate: this is not in the CISA KEV catalog, no public exploit code is identified, and EPSS data was not provided. The scope is limited to WordPress sites running this specific plugin at version 1.1.3 or below. Defenders should weigh that mass-scanning for vulnerable WordPress plugins is routine and low-effort for threat actors, making timely patching important despite the absence of confirmed active exploitation. The absent confidentiality impact reduces urgency compared to credential-theft or RCE-class flaws in the same CVSS band.

An unauthenticated attacker identifies a WordPress site running Outranking Plugin Options 1.1.3 or earlier, likely via mass scanning or WordPress-specific fingerprinting. The attacker sends a crafted HTTP POST request to the plugin's unprotected AJAX or REST endpoint - requiring no credentials or session token - and overwrites plugin option values, potentially injecting malicious content or altering SEO-related configuration. No public exploit code has been identified at time of analysis, but the low attack complexity makes manual exploitation straightforward once the vulnerable endpoint is known.