{"id":"CVE-2026-91828","published":"2026-10-02T06:16:42.857","lastModified":"2026-10-02T18:00:34.733","description":"The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/be25f7b5-5790-4db7-9056-b43b538a7183/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WordPress plugin fails to authenticate or validate nonces on a critical action that triggers slow server-side requests, allowing attackers to exhaust PHP worker pools and cause a complete site outage without any credentials or interaction.","exploitability":"Very easy to exploit with no preconditions - attackers can trigger the vulnerable action immediately with a simple HTTP request.","blast_radius":"High impact in real-world scenarios as attackers can easily make entire websites unavailable by exhausting server resources through repeated slow loopback requests.","remediation":"Upgrade to version 6.3.11 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","web","wordpress","resource-exhaustion"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:04:49.263Z"}}