CVE-2026-66455

The EPSS score for CVE-2026-66455 (0.00197) almost certainly understates the risk. This is a Broken Access Control vulnerability affecting the subscriber role in ReactPress—a WordPress plugin that bridges WordPress with React. That specific combination should concern you more than the raw CVSS suggests. WordPress's subscriber role is intentionally locked down: it grants essentially no administrative capabilities, limited to managing one's own profile. When a plugin allows subscribers to break out of that cage, it almost always means one of two things: the plugin routes critical actions entirely outside WordPress's permission pipeline, or the developers never properly integrated with WordPress's capability model in the first place. ReactPress sits in the second category. Its architecture bridges two fundamentally different authorization paradigms—WordPress's server-side PHP capability model versus React's client-side component state—and the translation layer between them is where permission bugs become predictable rather than surprising. The historical pattern is telling. This is the fourth major iteration of the same vulnerability class in WordPress ecosystems: AJAX handlers missing `check_ajax_referer` and capability checks in the 2000s, REST API `permission_callback` failures in the 2015-2018 wave, and now React bridge plugins. Each generation repeats the same genetic defect—treating the bridge layer as "your own" rather than WordPress infrastructure that must actively integrate with `current_user_can()`. What amplifies the risk here is the subscriber population itself. WordPress deployments don't use subscriber accounts as edge cases—they're the default mechanism for gated content, newsletter signups, membership tiers, and freemium models. Sites running ReactPress are specifically the ones doing sophisticated front-end work, which means they're disproportionately the sites with high subscriber counts and rich data to protect. You're not targeting a paranoid admin; you're targeting casual users who registered once for content and never thought about the account again. The client-side state persistence is also a critical dimension that elevates this beyond a traditional endpoint misconfiguration. When ReactPress populates client-side state with data the subscriber shouldn't access, remediating isn't just patching a PHP endpoint—it's invalidating cached sessions, forcing re-authentication, and potentially requiring users to clear local state. The vulnerability doesn't just grant access at one moment; it creates residual exposure that persists after a theoretical patch ships. Check your deployment: verify whether ReactPress exposes any custom endpoints or actions that process requests without calling `current_user_can()` or equivalent capability checks. If you're running ReactPress, audit which roles can access which components—the architectural split suggests permission gaps likely exist beyond what this single CVE captures. Given the remediation complexity and the pattern of bridge plugins trending toward abandonment, treat this as evidence of a structural permission foundation that may harbor additional untested flaws. The question isn't whether this specific CVE is serious—it's whether your ReactPress deployment is operating on a compromised permission foundation that hasn't been tested yet.

Reviewed through automated stages and approved by a human before publication.