12 Step Meeting List EUVD-2026-66885

Injection requires no authentication - any unauthenticated user with network access to the WordPress site can submit the malicious payload (PR:N, AV:N). Execution of the payload is contingent on a high-privilege WordPress user (administrator or equivalent) actively navigating to and viewing the activity log page in the admin backend (UI:R). The vulnerable plugin must be installed, active, and running a version in the range 3.17 through before 3.19.17. No special server configuration, feature flag, or non-default setting is required beyond the plugin being present. Exploitation is limited by the requirement for administrator interaction - the attack cannot self-propagate or execute without that triggering action.

The vendor CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the significant impact possible if an administrator views the poisoned log entry, but the UI:R requirement is a meaningful friction point - exploitation is not fire-and-forget. EPSS at 0.17% (7th percentile) is very low, consistent with SSVC's 'Exploitation: none' designation and the absence of a CISA KEV entry. The tension between a high CVSS (8.8) and very low EPSS suggests this is theoretically high-impact but in practice an unattractive target compared to fully unauthenticated, non-interaction-required vulnerabilities. SSVC flags 'Automatable: no,' further limiting mass-exploitation potential. Real-world priority should be moderate: patch promptly but this does not represent an emergency given no known active exploitation and the admin-interaction dependency.

An unauthenticated attacker identifies a WordPress site running the vulnerable plugin version and submits a crafted form entry containing a JavaScript payload (e.g., a cookie-stealing script) through any publicly accessible plugin-handled endpoint. The payload is stored in the activity log without sanitization. When a site administrator next opens the activity log in the WordPress dashboard, the script silently executes, exfiltrating the admin's session cookie to an attacker-controlled server and granting full administrative control over the WordPress site. No public exploit code has been identified at time of analysis.