The CVSS 6.5 for CVE-2026-66693 misleads if you treat it as a measure of real-world risk. This is broken access control in Motors, a WordPress theme serving car dealerships and automotive classifieds. The vulnerability allows a subscriber—anybody who can register on the site—to access resources that should require higher privileges. That matters not because the technical mechanism is complex, but because the exploitation prerequisite is effectively zero: open registration is the default for WordPress, and subscriber accounts cost nothing to obtain.
The analytical error is treating this like a typical server-side flaw. WordPress plugin broken access control通常是missing authorization checks on custom endpoints—developers rely on WordPress's role system without explicitly scoping permissions, and the capability model requires explicit whitelisting that gets omitted under time pressure. This isn't a sophisticated logic flaw; it's a requirements failure where the threat model never accounted for an attacker who already has a legitimate account.
What makes this specific to Motors is the data context. A subscriber who should see only their profile can reach vehicle leads, customer contact information, and sales pipeline data. These aren't personal data records—they're commercial intelligence. Automotive dealership sites function as nodes in a larger ecosystem: CRM integrations, lead management, inventory feeds, third-party listing syndication. Compromising one subscriber account opens a window into the dealer's active sales pipeline. The CVSS bucket treats this as 'some data access'; the blast radius is pipeline integrity compromise.
The EPSS of 0.00279 measures automated scanning probability, not targeted reconnaissance. Automotive and classifieds verticals have documented attacker interest in lead theft and competitive intelligence—this isn't random ransomware targeting, it's surgical interest in commercial data. Historical pattern from similar WordPress plugin BAC CVEs shows a consistent timeline: modest CVSS score, months of quiet, then weaponization when attackers recognize the business data value. The window isn't empty by accident; it's quiet because exploitation requires understanding Motors-specific data flows, making it a surgical tool rather than spray-and-pray.
Defenders should treat the subscriber registration vector as the exposure multiplier. Unlike vulnerabilities requiring admin compromise, this starts with account creation—trivial reconnaissance. Patch priority should reflect the automotive data context and the likelihood of targeted attacks against dealership sites, not the EPSS noise level. Additionally, many Motors installations are on agencies or dealerships with minimal security monitoring; abandoned or legacy installations represent a permanently unpatched population that EPSS doesn't model. A targeted attacker identifying a Motors site, registering a throwaway subscriber, and exfiltrating lead data at leisure is a scenario the metrics entirely miss.