In this article, we’ll explain what changes CVSS v4.0 brings to WordPress vulnerability information
What is CVSS?
CVSS stands for:
Common: Industry Standard
Vulnerability: Vulnerability
Scoring: Scoring
System: System
It is an acronym for a scoring system that quantifies various vulnerabilities based on their severity. Scores range from 0 to 10; factors such as whether authentication is required for an attack and the scope of the attack’s impact are factored into the score. Generally, vulnerabilities with a score of 7.0 or higher are classified as very dangerous.
CVSS has multiple versions, and its metrics have improved with each update.
Recently, CVSS V4.0 has become widely used.
What has changed in CVSS Version 4, and how does this affect the assessment of WordPress vulnerabilities?
CVSS Version 4 scores “exploitability” in greater detail than the previous v3.1.
Example: Whether the vulnerability requires some action by the user to be triggered
CVSS 3.1: Scored using a binary choice (required or not required)
CVSS 4.0: Scored using three options—“Requires (Passive),” “Requires (Active),” or “Does Not Require”
*“Passive” refers to actions that trigger the vulnerability through routine business activities that the user would hardly notice (such as simply opening an email)
.
Separation of Attack Complexity (AC) and Attack Requirements (AT)
Up to CVSS 3.1, AC combined two factors: the difficulty of bypassing defenses and the difficulty of meeting the conditions for the vulnerability to manifest incidentally; however, in version 4.0, these were separated
Elimination of “Scope”
In CVSS 3.1, “Scope” referred to the extent of the impact if the vulnerability were exploited.A “U” rating generally indicates that the vulnerability affects only the immediate vicinity of the system containing it; however, because this classification was considered ambiguous and difficult to understand, the concept of “Scope” itself was eliminated in CVSS 4. Instead, the impact on the vulnerable system itself (VC/VI/VA, etc.) and the impact on subsequent systems(SC, SI, SA, etc.) were clearly distinguished.
Introduction of Supplemental Metrics
Furthermore, in CVSS 4, “Supplemental Metrics” were introduced—additional information that does not affect the score but can be used to prioritize how to actually address vulnerabilities in real-world operations.
Automatable (AU) Whether the entire attack can be automated
Recovery (R) Ease of system recovery after an attack
Value Density (V) An estimate of the value (e.g., sensitive personal data) that can be obtained by attacking the target
Vulnerability Response Effort (RE) The effort required to fix the vulnerability or apply a patch
Provider Urgency (U) The level of urgency indicated by the program’s developer
As of 2026, CVSS 4 scores are gradually being assigned to various WordPress-related vulnerabilities. We will also be progressively transitioning our malware detection and removal security plugins, as well as our vulnerability scanning system, to the CVSS 4 standard.
This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of content using generated AI is permitted.
1. it is not for the purpose of learning by the generated AI. 2. only the summary or title of the page content at a level that does not lead to the solution of the user’s problem is shown to the user. 3. in the case of 2, a link to this content is shown to lead the user to this page.
