This vulnerability (CVE-2026-57661) affects Nexcess WPComplete plugin versions up to 2.9.5.5 and is classified as CWE-862 (Missing Authorization). It allows subscriber-level users to bypass access controls, resulting in unauthorized actions that can impact the integrity and availability of the system. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, required privileges at the level of a subscriber, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts. There is no vendor advisory or patch available at this time, and no known exploits have been reported.

An attacker with subscriber privileges can perform unauthorized actions due to broken access control, potentially modifying data or disrupting service availability. Confidentiality is not impacted. The vulnerability could lead to integrity and availability issues within affected WPComplete installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit subscriber privileges where possible and monitor for unusual activity related to WPComplete. No official remediation or temporary fix has been published by the vendor.