CRITICALCVSS v3.1 9.8Vulnerability
CVE-2026-113584
The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.
Properties
- Epss score
- 0.00186
- Cvss score
- 9.8
- First seen
- 2026-11-06T12:01:23+00:00
- Last seen
- 2026-11-06T12:01:23+00:00
- Euvd assigner
- WPScan
- Retrieved at
- 2026-11-07T06:44:43+00:00
- Src batch id
- euvd-20261106T133401Z-6f1d7b
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117897
- Score
- 9.8
- Euvd base score version
- 3.1
- Fetched at
- 2026-11-06T13:34:20+00:00
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-06T10:16:10+00:00
- Euvd base score
- 9.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Content hash
- 2ef57ac8d7776c0f9f593b037a529b320ccafe9806ef96c65ffd2a5c6688ad6d
- Published at
- 2026-11-06T06:16:39.943
- Euvd updated
- 2026-11-06T12:01:23+00:00
- Last modified
- 2026-11-06T20:09:13.780
- Epss percentile
- 0.0828
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph