CVE-2026-61984

The EPSS-CVSS mismatch on CVE-2026-61984 masks a more dangerous reality: unauthenticated access control failures in WordPress mobile-app integrations represent a structural blind spot where traditional CMS hardening assumptions don't apply. Here's what matters for defenders. First, the unauthenticated exploitation path is the critical detail. An attacker doesn't need credentials, a session token, or any foothold — they only need to know or discover the affected endpoint. With a CVSS of 7.5, this reads as significant but not critical, yet the EPSS of 0.00287 likely reflects the niche attacker community rather than actual risk. The security tooling and WordPress ecosystem institutional knowledge wasn't built to see mobile-layer vulnerabilities as a distinct threat category. CVSS and EPSS encode assumptions from a threat intelligence community that historically analyzed WordPress as a web application with predictable attack surfaces. Mobile integrations don't just add an endpoint — they fracture the implicit trust model that WordPress hardening guidance assumes. Second, the broken access control designation covers a wide spectrum — from benign enumeration to administrative takeover — depending on what endpoints are exposed and what actions they permit. You need to determine whether this vulnerability enables enumeration, data exfiltration, content modification, or user management. That framing changes the severity assessment entirely. Third, the mobile app sits in a position of implicit trust that the WordPress backend treats as a legitimate client. When access control fails at this layer, an attacker inherits the mobile layer's entire trust posture against the backend — creating cascade potential rather than a simple leak. This isn't opportunistic exploitation; it's surgical, and EPSS systematically underweights this profile because it can't model attacker motivation against structural exposure. What to do now: Identify whether WPMobile.App or similar mobile bridge plugins are installed. Treat any unauthenticated endpoint exposure in these plugins as equivalent to administrative access control failure until proven otherwise, because the trust inheritance means the blast radius compounds. If the plugin is deprecated or no longer actively maintained, the vulnerability becomes a permanent exposure that will outlive the maintenance window — factor this into your risk prioritization. The hardening measures you applied to wp-admin or REST endpoints may be irrelevant if the mobile integration bypasses those controls entirely. Assume the mobile layer can reach anything the plugin exposes, and verify authorization enforcement at that boundary, not just at the WordPress layer.

Reviewed through automated stages and approved by a human before publication.