Upcasted S3 Offload EUVD-2026-96470

Requires a valid authenticated WordPress account at Subscriber (low-privilege) level, per CVSS PR:L and the 'Subscriber Broken Access Control' description - this is the primary limiting factor, making open/self-service user registration on the target site the key enabling condition. The affected plugin is 'AWS S3 for WordPress Plugin - Upcasted' at version 3.1.0 or earlier. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N). Exploitation is bounded to the limited actions the missing authorization check exposes (low C/I/A impact), not full administrative control; sites that disable public registration or restrict subscriber creation substantially reduce exposure.

This is a moderate-severity (CVSS 6.3) missing-authorization flaw (CWE-862) in the 'AWS S3 for WordPress Plugin - Upcasted' (versions ≤ 3.1.0). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that requires low privileges (PR:L) - consistent with the description's 'Subscriber' broken access control, meaning any low-privilege authenticated WordPress account suffices. Impact is uniformly low across confidentiality, integrity, and availability, so this is a scope-limited authorization gap rather than a full takeover. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (authenticated low-privilege network attack with limited impact), so this reads as a genuine but not urgent issue: real priority is driven mainly by the low bar of needing only a subscriber account on sites that allow open registration, not by any evidence of active or automated exploitation. Note: the source is a single Patchstack advisory; no independent NVD CVSS or vendor confirmation of the patched version was provided, so the score and affected-version ceiling rely on that one source.

On a WordPress site running this plugin where self-registration is enabled, an attacker registers an ordinary subscriber account, authenticates, and invokes a plugin action or endpoint that fails to enforce a proper capability check. This lets the subscriber perform S3-offload operations or read/alter data they should not have access to, yielding limited confidentiality and integrity impact. No public proof-of-concept was provided, and the attack requires a valid (if low-privilege) account.