CVE-2026-61980

The CVSS 7.5 on CVE-2026-61980 demands scrutiny before you allocate incident response resources. The EPSS score of 0.00373 places this vulnerability in roughly the 15th percentile for exploitation likelihood within 30 days — a striking gap for an unauthenticated HIGH severity finding that warrants deprioritization logic, but with important caveats the raw metrics won't tell you. First, the install base argument cuts both ways. OMGF Pro is premium software requiring manual purchase and installation, which does constrain legitimate exposure. However, premium WordPress plugins get bundled into themes, distributed through nulled warez sites, and appear in auto-installer scripts on budget hosting at rates that can exceed legitimate installations by an order of magnitude. The 'small install base = low risk' equation only holds for paid, actively-maintained copies. A vulnerability in a plugin with 5,000 legitimate installs may face more exposure through pirated copies running on unmanaged hosting. Second, and more critically: what can this file download actually reach? Arbitrary file download CVEs vary enormously in impact. A download constrained to the plugin's font and CSS asset directory is a nuisance. One reaching wp-config.php exposes database credentials, salts, and API keys — a total compromise extending to every service those credentials touch. The CVSS treats these identically. Before assigning PagerDuty priority, verify the actual path traversal scope. If it's bounded to plugin assets, the EPSS is likely accurate. If it reaches broader filesystem, the risk calculation changes fundamentally. Third, examine the vendor's patch history. Internal discovery with a quiet patch suggests the vendor found their own architectural debt. Responsible disclosure means an external party found it first — the technique was in someone else's hands before the fix shipped. For arbitrary file download vulnerabilities, which are overwhelmingly side effects of deprecated file-handling patterns outside WordPress security norms, this distinction matters. If similar CVEs exist across this vendor's other products, treat it as a procurement signal. The real failure mode in WordPress isn't defenders ignoring high-priority CVEs — it's defenders deferring all patches until an incident forces action. The EPSS snapshot measures current exploitation probability, but it cannot account for the long-tail exposure window of pirated distributions or the compounding debt of an unpatched disclosed vulnerability sitting in thousands of stacks. Low EPSS may justify lower on-call priority, but it should trigger automated, frictionless patching — the remediation path most WordPress operators actually need.

Reviewed through automated stages and approved by a human before publication.