The CVSS 9.8 rating on CVE-2026-66424 demands attention, but the EPSS score of 0.00331 — roughly a 1-in-300 probability of exploitation within 30 days — should give you pause before allocating urgent response resources as if this were any other critical-severity finding.
This is an unauthenticated privilege escalation in a WordPress order notification plugin (versions 3.9.7 and below). The 'unauthenticated' descriptor is the critical technical detail: it means an attacker without any credentials can elevate to administrative access. In the WordPress plugin ecosystem, this typically manifests as broken access control on admin functions or direct object reference manipulation in code paths that handle order events. However, the specific attack surface — whether exploitation requires access to the WordPress admin panel or can be triggered through frontend requests — determines the real-world priority.
The low EPSS despite critical severity likely reflects a narrow exploitation window. This vulnerability class has a documented history in WooCommerce extensions and notification plugins, meaning experienced attackers have already depleted the easy targets. Defenders who have encountered this pattern before are faster to patch, which suppresses observed exploitation activity.
But here's what the EPSS doesn't capture: the temporal debt between disclosure and your actual patch deployment. Enterprise WordPress environments routinely run 60-90 day update cycles, while SMB and self-hosted installations may never update. That gap — not the 30-day EPSS window — is where systemic risk accumulates. Additionally, this plugin's maturity (3.9.7) suggests it's accumulated a substantial installed base that's increasingly stale, running on end-of-life PHP versions with no active monitoring.
Prioritize based on your environment: if you run this plugin and have automated patching, deploy immediately. If your update cycle exceeds 30 days, treat this as a compensating-controls priority until you can remediate. The blast radius of unauthenticated admin access in WordPress is catastrophic — it doesn't stay contained and becomes a pivot point for accessing database credentials, WooCommerce transactions, and adjacent SaaS integrations. The EPSS may be low now, but it recalculates rapidly the moment a reliable PoC circulates.