EUVD-2026-65168
GHSA-jh3h-655f-v3c9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Network-accessible unprotected endpoint with no credentials or interaction required; partial CIA impact reflects plugin-scoped access without full site compromise.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.
AnalysisAI
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against any WordPress site running WPLegalPages version 3.7.0 or earlier, regardless of server or WordPress configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.3 (High) is driven by the fully network-accessible, zero-complexity, zero-privilege, zero-interaction attack surface (AV:N/AC:L/PR:N/UI:N), which represents the most accessible possible exploitation pathway. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP POST request to a WPLegalPages AJAX endpoint (e.g., wp-admin/admin-ajax.php with a specific action parameter) or a REST API route that bypasses the plugin's authentication gate via an alternate code path. The attacker gains the ability to read, modify, or trigger restricted plugin functionality - such as accessing configuration data or altering legal page content - without holding any WordPress account. … |
| Remediation | The primary remediation is to update WPLegalPages to a version above 3.7.0 if a patched release has been published by the vendor; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wplegalpages/vulnerability/wordpress-wplegalpages-plugin-3-7-0-broken-authentication-vulnerability for a confirmed fix version, as no exact patched version number is available in the current dataset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations and identify those running WPLegalPages version 3.7.0 or earlier; immediately disable or uninstall the plugin if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wplegalpages
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today