WP w3all phpBB EUVD-2026-66947

The WP w3all phpBB plugin version 3.0.6 or earlier must be installed and active on a WordPress site. The CVSS vector PR:N confirms no authentication is required from the attacker's side to deliver the payload. However, exploitation requires UI:R - the victim must actively interact with the malicious link or page (e.g., click a crafted URL), meaning passive drive-by without victim action is not possible. The scope change (S:C) requires the payload to execute in the context of a user's browser session, making authenticated victims (logged into WordPress or phpBB) higher-value targets for session hijacking. No specific non-default configuration trigger is identified - the vulnerability appears present in the standard plugin installation.

The CVSS 7.1 score reflects a meaningful but not worst-case risk: AV:N and PR:N confirm the attack is remotely exploitable without credentials, while AC:L indicates no special conditions are needed. The UI:R requirement is the primary practical limiter - exploitation depends on convincing a target to follow a crafted link or visit a manipulated page. The S:C flag elevates seriousness, as attacker-controlled JavaScript runs in the victim's browser, enabling session hijacking, credential phishing, or forced actions on WordPress/phpBB. No EPSS score was provided, and neither KEV listing nor public POC was identified, suggesting this has not yet seen active or widespread exploitation. The plugin's niche deployment footprint further limits blast radius. Overall this is a genuine medium-high priority for affected sites but not a critical infrastructure emergency absent active exploitation evidence.

An attacker crafts a URL containing an XSS payload targeting a vulnerable parameter processed by the WP w3all phpBB plugin, then delivers this link to a logged-in WordPress or phpBB user via email, forum post, or social engineering. When the victim clicks the link, the malicious script executes in their browser under the site's origin, potentially exfiltrating session cookies, WordPress nonces, or phpBB authentication tokens back to the attacker. No public POC exists at time of analysis, but the zero-authentication requirement and low complexity make manual crafting straightforward for an attacker with basic XSS knowledge.