The most dangerous thing about CVE-2026-66677 isn't the CVSS 7.6 score — it's that this authentication bypass exists at the subscriber privilege level in a financial plugin processing real donations. WordPress developers treat subscriber access as a sealed compartment: these users can only read published content, so any code they can reach is assumed to be inherently safe. That assumption is why subscriber-accessible AJAX handlers, REST endpoints, and front-end actions frequently skip the security review that admin-level code receives. The result is a systematic gap where authentication and session logic bugs survive simply because they live in code paths nobody audits deeply.
Leyka handles donation workflows — payment card data, donor PII, and potentially regulated information depending on jurisdiction. When broken authentication lives at subscriber level in that context, you're not looking at a simple auth bypass. You're looking at a potential transaction manipulation and donor data exfiltration vector. The blast radius here isn't measured in privilege escalation steps; it's measured in transaction graph reach. Any authenticated user (and on donation sites with open registration, that's effectively anyone on the internet) can potentially access the entire donor database through a lateral code path that was never hardened.
The EPSS score of 0.00372 underweights this vulnerability because the metric was built for unauthenticated server-level RCEs, not authenticated financial workflow bypasses at open-registration sites. Similarly, CVSS treats this as authenticated-low-privilege, but on a donation site allowing public registration, the actual attack surface is unauthenticated in practice. The regulatory exposure window matters too — if this flaw existed for months before patching, GDPR Article 32 obligations around 'appropriate security measures' come into play.
What to do: Audit any subscriber-accessible AJAX handlers or REST endpoints in financial plugins you run. Assume zero implicit security from the WordPress role system at subscriber level — add explicit capability checks and nonce validation even for endpoints you believe are safe. If you're evaluating donation plugins, check whether they expose transaction or donor data handling at subscriber privilege, and treat that as a critical finding regardless of CVSS score.