EUVD-2026-85481
GHSA-qrmg-4q95-vm58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running AppMySite <=3.15.4
-
DeliverySend unauthenticated request to unprotected endpoint
-
ExploitMissing authorization check bypassed
-
ExecutionInvoke privileged action / modify state
-
ImpactLimited integrity or availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the target WordPress site runs the AppMySite plugin at version <= 3.15.4 with an exposed, network-reachable endpoint that omits the authorization/capability check. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special complexity are needed against a default installation; the primary limiting factors are that the AppMySite plugin must be installed and active, and the resulting impact is capped at low integrity and low availability (no data disclosure). The exact vulnerable feature/endpoint is not named in the advisory, so defenders cannot yet scope it to a specific function or configuration. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5) describes a remotely reachable, low-complexity, unauthenticated flaw requiring no user interaction - an easy-to-reach missing-authorization (CWE-862) issue in the AppMySite WordPress plugin. However, the impact is deliberately limited: no confidentiality (C:N) and only LOW integrity and availability (I:L/A:L), meaning an attacker can invoke a protected function they should not, altering some state or causing minor disruption, but cannot read sensitive data or fully compromise the site. There is NO EPSS score, NO CISA KEV listing, and NO public POC referenced in the provided data - exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. This is a real-but-modest issue: the unauthenticated network vector makes it opportunistically scriptable across exposed WordPress sites, but the capped integrity/availability impact keeps it well below critical priority. I question the A:L component - a pure broken-access-control/missing-authz write is typically integrity-only; the availability impact is not substantiated by the terse description. The Patchstack advisory is the sole reference, and no fixed version or exact vulnerable endpoint is named, so the specific abusable function cannot be confirmed from available data. |
| Exploit ScenarioDerived | An attacker sends a crafted request directly to an AppMySite plugin endpoint that lacks a capability/permission check, invoking a privileged action without authenticating. Because no user interaction or credentials are needed, this can be automated against any WordPress site running AppMySite <= 3.15.4 to tamper with plugin-managed state. No public proof-of-concept exploit is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated broken access control in the AppMySite WordPress plugin (all versions up to and including 3.15.4) lets remote attackers trigger privileged plugin functionality without any credentials or user interaction, degrading site integrity. Reported by Patchstack and mirrored as EUVD-2026-85481, the issue carries a published CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (base 6.5); our independent assessment agrees the attack path is remote, low-complexity, and unauthenticated, but caps the impact at low integrity (C:N/I:L/A:N) because no confidentiality or availability impact was demonstrated. The attack surface is limited to sites where the plugin is installed and active, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the trivial attack complexity means exploitation is straightforward once the specific unprotected endpoint is located.
RemediationAI
Patch status is not specified in the available intelligence: no fixed version is named by the vendor or by the Patchstack advisory, which only states that versions up to and including 3.15.4 are affected, so treat the plugin as unfixed until a patched release is published. Monitor the vendor and the Patchstack advisory page (https://patchstack.com/database/wordpress/plugin/appmysite/vulnerability/wordpress-appmysite-plugin-3-15-4-broken-access-control-vulnerability?_s_id=cve) and upgrade to the first release above 3.15.4 as soon as it is available. Because the vulnerable endpoint is not disclosed, virtual patching is imprecise: a WAF rule blocking unauthenticated POST/PUT/DELETE requests to the plugin's REST namespace (for example /wp-json/appmysite/*) and to any admin-ajax.php actions registered by the plugin is the most targeted compensating control, but it will fail if the offending handler is reachable under a different or renamed route. If the AppMySite mobile-app integration is not actively used, deactivating and removing the plugin eliminates the exposure entirely and is the cleanest interim measure. Blocking /wp-json/ or admin-ajax.php wholesale is more effective at closing the route but has significant side effects - it breaks other plugins, logged-in administrative workflows, and any headless or mobile clients - so it should be scoped narrowly and validated in a staging environment. Per our independent assessment the demonstrated impact is limited to low integrity with no data disclosure or availability loss, so mitigations can prioritise preventing unauthorized state changes over confidentiality-focused controls, and no evidence currently justifies emergency, site-wide takedown measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization), a broken access control weakness in the AppMySite WordPress plugin, a mobile-app builder that exposes plugin functionality through WordPress request handlers (typically REST API routes under /wp-json/ and/or admin-ajax.php actions). Handlers of this type are expected to verify that the calling user holds the appropriate capability via current_user_can() and, for state-changing requests, a valid nonce; when those checks are omitted, the endpoint becomes reachable by unauthenticated clients because WordPress routes REST and AJAX requests before any capability enforcement. The CPE record cpe:2.3:a:appmysite:appmysite:*:*:*:*:*:*:*:* uses a version wildcard rather than a bounded range, so the CPE itself does not enumerate a fixed version ceiling; the constraint 'up to and including 3.15.4' comes from the ENISA EUVD affected-version data and the Patchstack advisory title. The advisory does not name the specific vulnerable function or route, which means defenders cannot yet scope mitigations to a single action or parameter, and exploitation requires guessing or enumerating the unprotected handler - a low but non-zero barrier for an internet-reachable WordPress site.
Know when Appmysite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated network missing-authz (PR:N/AV:N/AC:L) yielding a low-integrity state change; I drop A:L to A:N as availability impact is unsubstantiated for a broken-access-control write.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB