CVE-2026-66468

CVE-2026-66468 describes a stored XSS vulnerability in Local Delivery Drivers for WooCommerce (versions <= 3.0.0) with a CVSS 3.1 base score of 7.1 and an EPSS score of 0.0018. These two numbers are telling you something important: the theoretical severity is moderate, but the probability of automated exploitation in the next 30 days is effectively zero. For practical prioritization, trust the EPSS over the CVSS here. The 'unauthenticated' classification in the WordPress plugin ecosystem warrants scrutiny you won't get from the CVE alone. This plugin creates custom roles—drivers, dispatchers, delivery managers—outside WordPress core's permission model. 'Unauthenticated' may not mean 'public-facing input accepts unsanitized data' but rather 'a role-check within the plugin's custom capability system can be bypassed.' These are different vulnerability classes with different remediation paths: the first needs input sanitization; the second needs a full review of the plugin's role-permission model. The more immediate operational concern is whether a patched version actually exists. The version constraint 'versions <= 3.0.0' typically signals that 3.0.0 is the highest affected release and fixes live above it—but you should verify that a 3.0.1 or later release has been published before generating remediation tickets. If no fixed version exists, your response shifts from 'apply the patch' to 'evaluate compensating controls or migrate to an active alternative,' which is a fundamentally different decision tree. The WooCommerce integration matters for impact assessment even when exploitation probability is low. This plugin touches order records, driver data, and delivery confirmations—an admin-context XSS here can pivot into the broader WooCommerce data layer containing customer PII, shipping addresses, and transaction history. The EPSS says this won't be exploited tomorrow. But if it ever is, the blast radius extends well beyond the plugin itself. Finally, the future-dated CVE identifier (CVE-2026-66468) suggests this may be a pre-disclosure placeholder or an incompletely coordinated release. This means automated scanners may flag the vulnerability before full remediation details are available, creating alert fatigue without actionable guidance. Treat the EPSS as your operational anchor until the patch situation clarifies.

Reviewed through automated stages and approved by a human before publication.