Starter Templates EUVD-2026-76203

Exploitation requires an active WordPress Contributor-level account on the target installation - such accounts must be explicitly granted by a site administrator and are not available to unauthenticated users or the general public by default. The Starter Templates plugin (≤4.7.5) must be installed and active. Impact is restricted exclusively to low-severity integrity modifications (I:L); no confidentiality exposure or availability impact occurs per CVSS. Sites that disable open user registration and restrict Contributor roles to verified, trusted individuals face substantially reduced risk. CVSS PR:L confirms the authentication dependency; exploitation by unauthenticated attackers is not possible.

The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) is well-calibrated to the actual impact: network-reachable, low complexity, but gated behind a PR:L Contributor account and limited strictly to integrity modifications with zero confidentiality or availability impact. The PR:L requirement meaningfully reduces the attack surface since Contributor accounts in WordPress must be explicitly assigned by an administrator and are not granted through open registration by default. Even a mid-sized municipal IT team in sanok should treat this as a routine plugin update cycle task rather than an emergency response, given the combination of low CVSS, authenticated-only exploitation, and absence of KEV listing or public POC. EPSS data was not provided in the input; however, the restricted prerequisite profile and low impact ceiling both suggest below-average exploitation likelihood. The primary real-world risk is on sites with loosely managed Contributor rosters or that allow untrusted third-party contributors access.

An attacker who holds or acquires a Contributor-level account on a target WordPress site running Starter Templates ≤4.7.5 crafts HTTP requests substituting arbitrary object IDs for template or content resources owned by other users or higher-privileged roles, causing the plugin to perform unauthorized modifications. The low access complexity means exploitation is mechanically straightforward once the Contributor credential is obtained. No public proof-of-concept code has been identified, reducing immediate opportunistic risk.