Loops & Logic EUVD-2026-74701

No special conditions - remote unauthenticated exploitation against any WordPress site with the Loops & Logic plugin installed and active in versions before 4.3.0. The attacker requires only HTTP network access to the target WordPress site's AJAX endpoint (typically /wp-admin/admin-ajax.php), which is enabled by default on all WordPress installations. No authentication, no account registration, no specific server configuration, and no user interaction are required. The sole limiting factor is that the vulnerable plugin must be installed and activated on the target site.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the network-reachable, zero-prerequisite nature of this flaw - any unauthenticated attacker who can issue an HTTP request to the target site can exploit it. SSVC rates this as automatable with partial technical impact, consistent with a bulk-harvest scenario that could sweep many WordPress installations simultaneously. A publicly available PoC raises the exploitability ceiling further, yet EPSS sits at only 0.17% (7th percentile) and SSVC records no confirmed active exploitation, suggesting the vulnerability has not yet been leveraged at scale - even a mid-sized municipal IT team in koszalin running WordPress should treat this as urgent given how trivially the attack can be automated. The primary real-world risk is mass enumeration of user email addresses and role assignments, which directly enables credential-stuffing, phishing, and targeted privilege-escalation follow-on attacks against identified administrator accounts.

An attacker sends a crafted unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the plugin's public template-data action parameter. Because a PoC is publicly available, this process can be scripted to sweep thousands of WordPress installations simultaneously, harvesting all user email addresses and role identifiers from each. The resulting data set is then used directly for targeted phishing campaigns or to identify administrator accounts for credential-stuffing attacks.