What is the CVSS score of CVE-2025-15689?

CVE-2025-15689 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Capella are affected by CVE-2025-15689?

A critical privilege escalation in the ThemeGoods Capella WordPress theme (versions up to 2.5.5) allows unauthenticated attackers to gain administrative control over affected WordPress sites without…

How to fix or mitigate CVE-2025-15689?

Within 24 hours, audit all WordPress installations to identify systems running ThemeGoods Capella version 2.5.5 or earlier and categorize by business criticality. Within 7 days, immediately disable and remove the vulnerable theme from all production systems, replacing it with a maintained alternative; apply available WordPress core and plugin security updates; and implement Web Application Firewall rules to block theme-specific paths as a temporary measure only. Over the following 30 days, monitor ThemeGoods vendor channels and WordPress security advisories for patch release; deploy any patched version immediately upon availability; and conduct security assessments to verify successful remediation.

Capella CVE-2025-15689

EUVD-2025-210756 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-08-20 Patchstack

GHSA-wq94-w84x-hxwv

Privilege Escalation Capella

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated (PR:N) network-reachable privilege escalation with no user interaction and low complexity yields full C/I/A impact, matching the reported 9.8 vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 12:32 vuln.today

CVE Published

Aug 20, 2026 - 12:06 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

AnalysisAI

Privilege escalation in the ThemeGoods Capella WordPress theme (versions up to and including 2.5.5) allows unauthenticated remote attackers to gain elevated privileges within a WordPress site, per a CVSS 3.1 base score of 9.8. Because the flaw requires no authentication and no user interaction, an attacker can leverage it directly over the network to compromise site integrity, confidentiality, and availability. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS and unauthenticated nature make it a high-priority patching target.

Technical ContextAI

Capella is a commercial WordPress theme distributed by ThemeGoods, identified by the CPE cpe:2.3:a:themegoods:capella. The weakness is classified as CWE-266 (Incorrect Privilege Assignment), meaning the theme grants a privilege level or capability to an actor who should not receive it. In WordPress themes, this class of flaw typically stems from AJAX handlers, REST endpoints, or theme-option/import routines that fail to enforce capability checks (current_user_can) or nonce validation, allowing a request to perform privileged actions or elevate an account. The specific vulnerable code path was not disclosed in the available data beyond the privilege-escalation classification.

RemediationAI

No vendor-released patch version is identified at time of analysis; the input confirms only that versions <= 2.5.5 are affected, so administrators should check ThemeGoods/Patchstack for a fixed release (a version above 2.5.5) and upgrade to it as the primary fix once available. Consult the Patchstack advisory for the authoritative fix status: https://patchstack.com/database/wordpress/theme/capella/vulnerability/wordpress-capella-theme-2-5-5-privilege-escalation-vulnerability?_s_id=cve. As compensating controls until a patched version is confirmed, deploy a WordPress WAF or Patchstack vApp virtual patch to block the exploit request pattern; restrict access to wp-admin and the site's AJAX/REST endpoints (admin-ajax.php, /wp-json/) by IP allowlist where feasible, accepting that this can break legitimate front-end AJAX features; and audit user accounts and roles for unexpected privilege grants, removing any unrecognized administrator accounts.