WPLegalPages EUVD-2026-65168

No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against any WordPress site running WPLegalPages version 3.7.0 or earlier, regardless of server or WordPress configuration. The plugin must be installed and active on the target site. Limiting factors: the partial CIA impact (C:L/I:L/A:L) means a single exploit step does not yield full administrative control; further chaining would be needed to escalate to a full site compromise. There is no indication of platform-specific prerequisites (OS, PHP version, hosting environment) beyond a standard WordPress deployment.

The CVSS 3.1 score of 7.3 (High) is driven by the fully network-accessible, zero-complexity, zero-privilege, zero-interaction attack surface (AV:N/AC:L/PR:N/UI:N), which represents the most accessible possible exploitation pathway. However, the Unchanged scope (S:U) and only partial impacts across all three CIA pillars (C:L/I:L/A:L) limit the worst-case outcome in a single exploit step; this is not a straight path to full site takeover. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, meaning real-world exploitation frequency is currently unknown rather than confirmed. The Patchstack reporting and EUVD assignment (EUVD-2026-65168) provide credible vendor-side confirmation of the issue. Overall assessment: elevated priority for any WordPress operator running this plugin given the zero-barrier exploitation path, but not an immediate critical-incident-level event absent active exploitation evidence.

An unauthenticated attacker sends a crafted HTTP POST request to a WPLegalPages AJAX endpoint (e.g., wp-admin/admin-ajax.php with a specific action parameter) or a REST API route that bypasses the plugin's authentication gate via an alternate code path. The attacker gains the ability to read, modify, or trigger restricted plugin functionality - such as accessing configuration data or altering legal page content - without holding any WordPress account. The low attack complexity makes this suitable for automated scanning tools targeting WordPress installations at scale.