This vulnerability, identified as CVE-2026-66455, affects rockiger ReactPress versions up to and including 3.4.0. It is classified as CWE-862, indicating missing authorization controls that result in broken access control for subscriber-level features. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) reflects a network attack vector requiring high attack complexity and low privileges, with no user interaction needed. Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability. The vulnerability is published and recognized but lacks a vendor-provided patch or official remediation at this time.

The vulnerability allows unauthorized access to subscriber-restricted resources or functions, potentially leading to limited data disclosure, modification, or disruption of service. The CVSS score of 6.0 reflects a medium severity impact with partial loss of confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to ReactPress instances and monitor for suspicious activity related to subscriber functionality. Avoid exposing the affected versions publicly where possible.