What is the CVSS score of EUVD-2026-76796?

EUVD-2026-76796 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate EUVD-2026-76796?

Within 24 hours: identify all WordPress installations using WP Component plugin versions 2.2.4 and earlier; assess which are internet-exposed and review recent administrator accounts and WordPress audit logs for unauthorized modifications. Within 7 days: disable user self-registration in WordPress settings (wp-admin → Settings → General) if not required for business; implement Web Application Firewall rules blocking unauthenticated requests to wp-admin and wp-json endpoints; establish monitoring alerts for user creation and wp_options modifications. Within 30 days: request a patched version from the plugin developer, replace WP Component with an alternative plugin providing equivalent functionality, or deactivate and remove the plugin entirely if unused.

WP Component EUVD-2026-76796

| CVE-2026-85681 CRITICAL

Improper Privilege Management (CWE-269)

2026-09-12 contact@wpscan.com

GHSA-pjpf-74g9-grmh

WordPress Privilege Escalation

9.8

CVSS 3.1 · Vendor: wpscan

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site running WP Component ≤2.2.4
Delivery

Send unauthenticated request overwriting registration options
Exploit

Set default_role to administrator
Execution

Self-register new account
Persist

Log in with admin privileges
Impact

Install malicious plugin for full control

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitable against any single-site WordPress install running WP Component ≤2.2.4 with the plugin active - no authentication, no user interaction, and default configuration suffice, since the vulnerable action is registered for unauthenticated (nopriv) callers and performs no capability or nonce check. The description explicitly ties full takeover to single-site installations relying on the registration/default-role option path; on multisite the takeover route via self-registration may not apply, though arbitrary option overwrite remains possible. The only real limiting factors are the plugin being installed and active and the target being a single-site deployment.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is credible: exploitation is remote, unauthenticated, requires no user interaction, and the described option-overwrite-to-admin path genuinely yields full compromise. The one tension is between the very high CVSS and the low EPSS (0.14%, 3rd percentile), which reflects the plugin's small install base rather than any difficulty of exploitation - the technique itself is trivial and reliable. There is no CISA KEV listing and no POC flag in the input, so this is high-impact-but-not-yet-observed-in-exploitation. Note the description explicitly scopes full takeover to single-site installations; on multisite, registration/role semantics differ and the impact may be reduced, so verify against the target's install topology.
Exploit ScenarioDerived	An attacker sends a single crafted unauthenticated POST to the plugin's admin-ajax action, setting option 'users_can_register' to 1 and 'default_role' to 'administrator'. They then register a new account through the normal WordPress signup flow, receive administrator privileges, and log in to install a malicious plugin/theme for full server-side control. No credentials or user interaction are needed and the requests are scriptable.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 12, 2026

Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory describes the plugin as vulnerable 'through 2.2.4' without naming a fixed release. Until a patched version is confirmed, deactivate and remove the WP Component plugin, which fully eliminates the exposed unauthenticated action. If the plugin cannot be removed, block or restrict access to the vulnerable admin-ajax action at a WAF/reverse-proxy layer (filtering the specific action parameter) and, as a hardening step, force 'users_can_register' off and 'default_role' to 'subscriber' via wp-config or code so that even a successful option write cannot silently enable admin registration - though a determined attacker could overwrite other options too, so this is a stopgap, not a fix. Monitor for the WPScan-referenced fix and consult https://wpscan.com/vulnerability/c602bd9e-a825-4990-a66b-1403bbeb2cee/ for updates.

Affected VersionsENISA

WP Component 0 ≤2.2.4

Affected Packages

euvd wp_component no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WordPress plugins register callbacks via the admin-ajax.php action hooks, and the wp_ajax_nopriv_ variant intentionally serves unauthenticated requests. Secure handlers must gate destructive operations with check_ajax_referer() (nonce) and current_user_can() (capability) checks. Here the plugin registers a nopriv action that calls update_option() with both key and value taken directly from the request, an instance of CWE-269 (Improper Privilege Management) - though the root cause is more precisely a missing authorization/nonce check (CWE-862/CWE-352). Since wp_options controls sitewide settings including registration policy and default user role, arbitrary option write is equivalent to full administrative control on a single-site install.

Know when WordPress gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (wpscan) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Remote unauthenticated arbitrary option write with no interaction yields full admin takeover, so PR:N/UI:N and C/I/A all High; scope unchanged as impact stays within the WordPress instance.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 12, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Sep 12, 2026 - 06:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 12, 2026 - 06:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.

Executive ViewAI

Why It Matters

Organizations using WP Component plugin version 2.2.4 and earlier risk complete loss of website control to unauthenticated attackers who can establish permanent administrative access without valid credentials. With no vendor patch available, immediate interim mitigation is required to prevent unauthorized site compromise and potential data breach.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable user registration (wp-admin Users → Registration settings, or set wp_options users_can_register = 0) if not required for business; restrict wp-admin directory access via Web Application Firewall, IP whitelisting, or authentication gateway; implement comprehensive audit logging for user account creation and WordPress option modifications; audit administrator account list for unauthorized entries; consider relocating WordPress login URL to non-standard path.

Threat Intelligence Overview

EPSS Score

0.1%

Top 97% exploitable

Prevalence

Rare

obscure WordPress plugin, tiny install base (EPSS 3rd percentile)

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.