For CVE-2026-6147, the CVSS 8.8 score is technically accurate but operationally misleading if you treat it as a standalone prioritization signal. This is an authenticated arbitrary file upload in a WordPress plugin (rest_replace_media() function) that can lead to RCE—but the authentication requirement fundamentally changes the threat model in ways the CVSS framework doesn't权重.
The EPSS score of 0.00657 is the more useful signal here, but you need to understand what it's actually telling you. It measures the probability of opportunistic external exploitation—script kiddies, mass scanners, automated exploitation kits. Against that threat model, this CVE is appropriately low-priority. An attacker needs valid Author-level WordPress credentials to exploit it, and Authors can already upload media files through the standard WordPress admin interface by design. This isn't an exposed attack surface in the traditional sense.
However, three factors should prevent reflexive deprioritization. First, the attack surface isn't zero—WordPress powers 40% of all websites, many with open registration, compromised accounts through unrelated vulnerabilities, or insider threats. The EPSS metric specifically doesn't capture targeted attacks, which is precisely the threat profile that applies here. Second, the technical question of whether this REST endpoint bypasses WordPress's built-in validation (filename sanitization, MIME type checking, metadata processing) matters significantly. If it does, this isn't just a redundant upload path—it's a bypass of controls that authenticated users are otherwise subject to. Third, abandoned sites that never patch represent persistent residual risk; the vulnerability doesn't become more exploitable over time, but credentials protecting it become more accessible through phishing, credential stuffing, and other unrelated compromises.
For prioritization: if you run WordPress with this plugin and have open registration or high-value Author accounts, treat this as higher urgency than the EPSS suggests. If the plugin simply exposes a parallel upload path without meaningful bypass of WordPress's native controls, deprioritizing it relative to unpatched vulnerabilities with higher EPSS scores is sound. Either way, don't let CVSS drive the decision alone—context matters more than the numerical score here.