WP Rollback EUVD-2026-96326

Exploitation targets the WP Rollback plugin (versions from unknown through 3.1.2) on WordPress; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required, but the high attack complexity (AC:H) means success depends on conditions the attacker does not control - such as sensitive data actually being present/embedded, specific plugin state, or timing. The description does not name a specific configuration toggle; the limiting factors are therefore the high complexity and the requirement that exploitable sensitive data exist in the relevant responses. The precise data exposed is not described and should be confirmed with the vendor/Patchstack advisory to assess real impact.

This is a moderate-severity information disclosure flaw (CWE-201) in the WP Rollback WordPress plugin, rated CVSS 5.9. The provided CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, unauthenticated vector with high attack complexity, high confidentiality impact, and no integrity or availability impact - consistent with an attacker retrieving embedded sensitive data rather than achieving code execution. The signals are internally consistent but modest: the single-source Patchstack reference drives the entry, and there is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept provided in the input, so exploitation probability cannot be quantified from the data. The AC:H rating is the key moderating factor - it implies exploitation depends on conditions outside the attacker's control (timing, specific configuration, or data actually being present/embedded), which lowers real-world urgency below what the C:H component alone might suggest. Net: this is a credible but not high-priority issue absent evidence of active exploitation; the high confidentiality impact warrants patching, but the high complexity and lack of any exploitation signal argue against emergency treatment. Note the description's vague phrasing ('Retrieve Embedded Sensitive Data') does not specify WHAT data is exposed, so the C:H rating should be verified against the actual exposed data before assuming severe impact.

A remote, unauthenticated attacker interacts with a WP Rollback-equipped WordPress site and, under specific conditions reflected by the high attack complexity, causes sensitive information to be embedded in server responses they can observe. The exposed data is then harvested for reconnaissance or further attacks. No public exploit code is identified in the provided data, and the AC:H rating suggests the attack is not trivially repeatable on demand.