SiteSkite EUVD-2026-85529

Requires a valid authenticated account with at least Contributor-level privileges on a WordPress site running the SiteSkite plugin version 2.1.7 or earlier (PR:L). Exploitation is network-reachable with low complexity and no user interaction, but is limited to modifying objects (integrity only, I:L) - there is no data disclosure (C:N) or denial of service (A:N). The primary limiting factor is that the attacker must already hold Contributor access, so sites that do not permit self-registration or that restrict authoring roles substantially reduce exposure.

This is a low-real-priority issue whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but authenticated flaw requiring at least Contributor-level access, with no confidentiality or availability impact and only Low integrity impact - an attacker can act on objects belonging to other users but cannot read sensitive data or take the site down. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation interest; per the precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC decision data. The requirement for a valid Contributor account materially limits the population of potential attackers to users already granted authoring access, so despite the network attack vector this is best treated as a low-severity authorization defect rather than an urgent patch. Note the input Tags label this 'Authentication Bypass,' which conflicts with the CWE-639 (IDOR/broken object-level authorization) classification and the PR:L vector - this is an authorization flaw exploitable BY an authenticated user, not an authentication bypass.

An attacker who registers or obtains a Contributor account on a WordPress site running SiteSkite <= 2.1.7 sends requests referencing object identifiers (e.g., post, resource, or record IDs) belonging to other users, and the plugin fails to verify ownership before acting. Because CVSS shows AV:N/AC:L/PR:L with only Low integrity impact, the attacker can tamper with or modify another user's objects but cannot read confidential data or cause an outage. No public exploit code was identified at the time of analysis.