EUVD-2026-85489
GHSA-h7mp-657p-hg4h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Netgsm ≤2.10.0
-
ExploitSend crafted unauthenticated request
-
ExecutionBypass authentication via alternate name/channel
-
ImpactPerform limited integrity-affecting action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate name authentication
|
| Exploitation Conditions | Requires a WordPress site with the Netgsm plugin version ≤2.10.0 installed and active. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and the vector is network-remote against default configurations. The primary limiting factors are the low real-world install base of this niche plugin and the impact being confined to low integrity (I:L) - no confidentiality or availability consequences. The description does not name the specific bypassed endpoint, so defenders should consult the Patchstack advisory to identify the exact affected feature. |
| Impact | This is a moderate-severity issue that does not rise to genuine priority. The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects an unauthenticated, network-reachable, low-complexity bypass, but with impact limited to integrity only (I:L) and no confidentiality or availability effect. CWE-289 (Authentication Bypass by Alternate Name) aligns with the 'Unauthenticated Bypass' description - an attacker reaches functionality intended to be gated without proper authentication, but the concrete, low integrity impact caps real-world severity. No EPSS score, no CISA KEV listing, and no public proof-of-concept are provided, so there is no signal of active or automatable exploitation: no public exploit identified at time of analysis. The single Patchstack advisory is the only source, and no fixed version is stated. Net: a real but low-urgency flaw whose 5.3 score is honest rather than inflated; patch on a normal cadence rather than emergency. Note the description is extremely terse - it names no specific bypassed endpoint or capability - so the exact integrity effect should be verified against the Patchstack advisory. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to the Netgsm WordPress plugin (≤2.10.0) that reaches a function relying on a weak or alternate-name authentication check, bypassing the intended gate. This lets the attacker perform a limited integrity-affecting action (e.g., altering plugin state or triggering a protected operation) without credentials. No public exploit code is available, and the impact is confined to low integrity with no data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated bypass in the Netgsm WordPress plugin (versions up to and including 2.10.0) lets remote attackers bypass an access-control check and make limited unauthorized changes to site state (C:N/I:L/A:N), with no confidentiality or availability impact. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N - network-remote, no authentication and no user interaction required on a default WordPress install with the plugin active. No public exploit identified at time of analysis, no CISA KEV entry, and the plugin has a small real-world install base, so overall risk is moderate rather than urgent despite the unauthenticated attack path.
RemediationAI
No vendor-released patch is identified in the provided intelligence; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/netgsm/vulnerability/wordpress-netgsm-plugin-2-10-0-bypass-vulnerability-vulnerability?_s_id=cve) is the authoritative source to confirm whether a fixed release has shipped, and administrators should check there and in the WordPress plugin repository before deciding. If the plugin is not operationally required, the most reliable mitigation is to deactivate and delete it - this fully removes the attack surface but forfeits Netgsm SMS/notification functionality and any stored configuration. If Netgsm integration must remain, restrict access to the plugin's request endpoints (for example, via WAF rules that block or challenge unauthenticated requests to paths under /wp-content/plugins/netgsm/, or via reverse-proxy/IP allowlisting if the integration is only used from known sources) - the trade-off is that legitimate Netgsm callbacks or front-end features may break and require exception tuning. Because the flaw is in the plugin's own access-control logic, WordPress core hardening (strong admin credentials, disallowing file edits) will not close it; instead, keep the plugin at the newest available release, monitor web logs for anomalous unauthenticated requests to the plugin's endpoints, and review site state for unauthorized low-impact modifications that could indicate exploitation. As with any WordPress plugin, only install from trusted sources and re-evaluate necessity of the plugin periodically.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-289 (Authentication Bypass by Alternate Name) flaw in the Netgsm plugin, a PHP extension for WordPress that provides Netgsm SMS/notification integration. CWE-289 covers cases where an application performs an authentication or authorization decision based on the name or identifier of a resource or actor, but fails to account for alternate names, encodings, or equivalent identifiers that resolve to the same protected resource - so a crafted alternate name slips past the check that a canonical name would fail. In a WordPress context this typically means the plugin trusts a request-supplied value (such as a parameter, action name, or callback identifier) to satisfy its own access-control routine instead of relying on WordPress's capability checks (e.g., current_user_can) or nonce verification. The supplied CPE (cpe:2.3:a:netgsm:netgsm:*:*:*:*:*:*:*:*) and the EUVD affected-version entry ('Netgsm n/a ≤2.10.0') confirm the entire plugin line through 2.10.0 is in scope. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is confirmed by the independent assessment, meaning the bypass is exploitable over the network with no privilege or victim interaction, but the impact is capped at low integrity (I:L); there is no disclosure of data or degradation of service. The exact bypassed endpoint is not named in the public description, so defenders should read the Patchstack advisory to identify the specific feature and confirm the precise request shape.
Know when Netgsm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network bypass (AV:N/AC:L/PR:N/UI:N) with impact limited to a low integrity action and no confidentiality or availability effect, matching CWE-289.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing Authorization vulnerability in Netgsm.9.19. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Secu
Exploit-DB