EUVD-2026-93062
GHSA-49gp-xp7v-j798
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Sermon'e
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionHit endpoint missing authorization check
-
ImpactRetrieve restricted data (C:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress installation with the Sermon'e plugin (vendor beplusthemes) active at version 1.0.2 or earlier; exploitation then requires no authentication, no user interaction, and no special non-default configuration per PR:N/UI:N/AC:L. The limiting factor is deployment scope rather than attack prerequisites: the plugin must simply be installed and enabled, and only data within the plugin's broken-access-control scope is exposed (C:H, with no integrity or availability impact). The specific vulnerable feature/endpoint is not described in the available data and should be confirmed from the Patchstack advisory. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact - consistent with CWE-862 (Missing Authorization) exposing data that should be protected. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation likelihood and real-world activity cannot be quantified from the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The 7.5 base score reflects ease of access rather than confirmed exploitation, and the real-world priority is tempered by the narrow footprint of the affected product (a niche WordPress sermon/church plugin, not a ubiquitous component). Net: credible and easy to exploit where the plugin is installed, but likely low aggregate exposure and no evidence of active or automated exploitation. Patch availability is implied by the Patchstack advisory (affected 'versions <= 1.0.2') but a specific fixed version is not stated in the input and should be confirmed with the vendor/Patchstack. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Sermon'e <= 1.0.2, invoking a plugin endpoint or action that lacks a proper authorization/capability check. Because of the missing access control, the response discloses data or functionality that should be restricted, yielding a confidentiality breach (C:H) without requiring login or user interaction. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.
RemediationAI
No vendor-released patch identified at time of analysis: the available input provides only the affected range (Sermon'e <= 1.0.2) and a Patchstack advisory link, and no exact fixed version is stated, so administrators should monitor https://patchstack.com/database/wordpress/plugin/sermone/vulnerability/wordpress-sermon-e-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve and the plugin's WordPress.org page, then update the plugin as soon as a release above 1.0.2 is published (deactivate auto-update gaps by testing on staging first). Until a fix is confirmed, the most reliable compensating control is to deactivate and, if not required, remove the Sermon'e plugin entirely, which eliminates the exposure but also removes all sermon display/shortcode functionality from the site. If the plugin must stay active, restrict access to the plugin's endpoints at the edge: block or rate-limit direct HTTP requests to the plugin directory (for example /wp-content/plugins/sermone/ and any associated admin-ajax.php or REST actions it registers) for unauthenticated clients using a WAF or reverse-proxy rule, accepting the trade-off that legitimate public-facing plugin features may break and that WAF coverage is signature-dependent and must be tuned as the exact endpoint is identified. Additional hardening that reduces blast radius without removing the flaw includes placing the site behind a VPN or IP allowlist for non-public content, and disabling any plugin shortcode or block that renders the leaked data on public pages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a third-party WordPress plugin, Sermon'e, distributed by vendor beplusthemes and tracked by the CPE cpe:2.3:a:beplusthemes:sermon'e:*:*:*:*:*:*:*:*, which matches all versions up to and including 1.0.2. The root cause class is CWE-862 (Missing Authorization), a broken access control weakness in which a function, AJAX action, REST route, or direct request handler is registered without a capability check such as current_user_can() or a nonce/permission_callback, so WordPress dispatches the request to the handler before any identity or privilege verification occurs. Because WordPress plugins execute inside the parent CMS's request lifecycle, such missing checks are reachable over HTTP by anyone who can reach the site, which is exactly what the CVSS vector encodes: PR:N confirms no authentication is needed, UI:N confirms no victim interaction, and AC:L confirms no special conditions beyond the plugin being present. The impact is scored as C:H/I:N/A:N, so the weakness leaks or discloses protected content rather than allowing modification or denial of service, and the Patchstack tagging as an authentication bypass is consistent with a handler that returns privileged data to callers who were never authenticated. Note that the underlying WordPress core is not implicated; only the plugin's own authorization logic is missing.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable missing authorization (PR:N/AV:N/AC:L) exposing restricted data only, so C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
Executive ViewAI
The Sermon'e WordPress plugin (versions 1.0.2 and earlier) is affected by a high-severity vulnerability that allows unauthenticated attackers to access data the plugin is intended to protect. Any organization using this plugin on its website faces a direct risk of unauthorized data exposure, which could lead to reputational damage and regulatory scrutiny. Leadership should immediately inventory affected deployments and implement interim mitigations to prevent data leaks.
No vendor-released patch identified at time of analysis. Interim mitigations include: disabling or removing the Sermon'e plugin (version 1.0.2 and earlier) if not essential; deploying a WAF rule to block unauthorized access to the vulnerable endpoint (once identified via Patchstack advisory); restricting plugin functionality to authenticated users; and monitoring for a vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB