Unauthenticated Broken Access Control in Total Upkeep Plugin by BoldGrid
CVE-2026-66708

8.2HIGH

Key Information:

Vendor

WordPress
Status
Total Upkeep
Vendor
CVE Published:
6 August 2026

What is CVE-2026-66708?

Total Upkeep Plugin versions up to 1.17.2 are exposed to an unauthenticated broken access control vulnerability, allowing unauthorized users to access sensitive areas of the application. This loophole can be exploited to manipulate plugin functionalities without proper authentication, potentially compromising the security of the WordPress sites using this plugin.

Affected Version(s)

Total Upkeep <= 1.17.2

References

https://patchstack.com/database/wordpress/plugin/boldgrid...
vdb-entry

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Ba Khanh - HPT Vietnam Corporation | Patchstack Bug Bounty Program
.