Is CVE-2026-7640 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7640 being exploited in the wild.

How severe is CVE-2026-7640?

Medium severity, with a CVSS score of 6.4, published 14 July 2026.

Which products and versions are affected?

Aguila Technologies WP Customer Area <= 8.3.5.

Is there a fix for CVE-2026-7640?

A patch was published on 2026-07-06: Version 8.3.6 released to fix the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7640 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7640?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7640: Aguila Technologies WP Customer Area Stored XSS in shortcode

Q: Is there a fix for CVE-2026-7640?

A patch was published on 2026-07-06: Version 8.3.6 released to fix the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-7640 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-7640?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7640 · Severity: medium · CVSS 6.4 · Published 2026-07-14

WP Customer Area is a WordPress plugin used to manage private content and file sharing between a site and its customers. A security flaw allows users with basic contributor permissions to embed malicious scripts into pages. These scripts execute automatically when other users, including administrators, visit the affected page, potentially leading to unauthorized actions or data theft.

Quick answers

Is CVE-2026-7640 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7640 being exploited in the wild.
How severe is CVE-2026-7640?: Medium severity, with a CVSS score of 6.4, published 14 July 2026.
Which products and versions are affected?: Aguila Technologies WP Customer Area <= 8.3.5.
Is there a fix for CVE-2026-7640?: A patch was published on 2026-07-06: Version 8.3.6 released to fix the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7640 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7640?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'type' attribute of the `customer-area-protected-content` shortcode. An authenticated attacker with Contributor-level access or higher can exploit this by injecting arbitrary web scripts into a page via the shortcode. Because the script is stored on the server, it executes in the browser of any user who views the compromised page. This vulnerability was addressed in version 8.3.6.

Affected products

Aguila Technologies WP Customer Area <= 8.3.5

Timeline

2026-07-06: patched: Version 8.3.6 released to fix the vulnerability.
2026-07-14: disclosed: Public disclosure of CVE-2026-7640.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.