EUVD-2026-95744
GHSA-5fgm-jmv9-4h4r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WordPress user
-
DeliverySend request to unprotected theme action
-
ExploitBypass missing authorization check
-
ExecutionPerform privileged operation
-
ImpactDegrade availability or alter data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privilege WordPress account (CVSS PR:L) on a site running the ThemeHunk Th Shop Mania theme at version 1.9.1 or earlier; the vulnerable theme must be installed and active. The flaw is a missing authorization/capability check on a theme action, so the attacker leverages their valid session to invoke an operation that lacks proper access control. The limiting factors are the requirement for a valid account (not anonymous/unauthenticated), the narrow deployment footprint of this specific theme, and the need for the affected (≤1.9.1) version; no user interaction is required (UI:N) and the attack is remote over the network (AV:N). |
| Impact | This is a moderate-severity Missing Authorization flaw (CWE-862) in the ThemeHunk Th Shop Mania WordPress theme, versions up to and including 1.9.1. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) scores 7.1 and indicates network-reachable, low-complexity exploitation that requires an existing low-privilege authenticated account (PR:L), with no user interaction. Impact is skewed toward availability (A:H) and limited integrity (I:L) with no confidentiality impact (C:N). No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the only source is a single Patchstack advisory. The PR:L requirement meaningfully limits real-world risk: an attacker must already hold a valid WordPress account on the target, so this is not a zero-auth internet-wide threat. The A:H rating is notable and somewhat atypical for a broken-access-control theme flaw, where integrity impact is usually the dominant concern; because the Patchstack entry classifies this as Broken Access Control, the exact mechanism producing high availability impact is not detailed and should be verified against the vendor/Patchstack advisory. Overall this is a credible but not urgent priority - real exploitation value is gated behind authentication and a niche theme footprint. |
| Exploit ScenarioDerived | A low-privilege authenticated user (e.g., a subscriber or customer account on a WordPress shop running the Th Shop Mania theme ≤1.9.1) sends a request to a theme function that fails to check authorization. Because the action lacks a proper capability or nonce check, the attacker performs a privileged operation they should not be allowed to, degrading site availability or tampering with limited data. No public exploit code was provided in the input, and exploitation requires an existing account on the target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).
RemediationAI
No vendor-released patch was identified at time of analysis for CVE-2026-105883, so remediation currently depends on compensating controls rather than a documented fixed version. The most reliable control is to deactivate Th Shop Mania and migrate to an actively maintained theme, accepting the resulting loss of the theme's storefront layout and customization work; if the theme must stay in place, contact ThemeHunk directly for a fixed build and monitor the Patchstack advisory page for an updated release before assuming any version is safe. Because exploitation requires an authenticated low-privilege account (PR:L), tightening account hygiene meaningfully raises the bar: audit and remove unused subscriber/customer accounts, restrict self-registration and open membership plugins, and downgrade or delete any role that does not need to log in - the trade-off is that legitimate customer or contributor workflows may break. Virtual patching or WAF rules that target the theme's AJAX/REST entry points and block requests from low-privilege sessions attempting privileged theme actions can blunt exploitation, but such rules are signature-dependent, may produce false positives against legitimate theme features, and should be treated as temporary until an upstream fix lands. Finally, log and alert on unexpected changes to theme options and storefront configuration, since the low-integrity (I:L) impact means unauthorized modifications may otherwise go unnoticed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Th Shop Mania is a commercial WordPress theme from ThemeHunk, distributed through the official theme ecosystem and tracked under the CPE cpe:2.3:a:themehunk:th_shop_mania:*:*:*:*:*:*:*:* (wildcard version, reflecting that the advisory covers all releases up to and including 1.9.1). The defect is CWE-862, Missing Authorization: a theme operation - typically an AJAX action registered against admin-ajax.php, a REST route, or an admin-post handler that mutates theme options or storefront settings - is reachable without a corresponding current_user_can() capability check (and, in many such cases, without a valid nonce check). Because the underlying handler trusts the caller's session rather than verifying the required role or capability, any logged-in account, including a low-privilege subscriber, can trigger it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H confirms the root cause class: network-reachable, low-complexity, authenticated with low privileges, no user interaction, with impact confined to availability plus a low-integrity effect rather than data disclosure.
Know when Th Shop Mania gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Remote, low-complexity action reachable by a low-privilege authenticated user (PR:L) with no interaction; missing authorization yields limited integrity and high availability impact, no confidentiality loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.
Executive ViewAI
The Th Shop Mania theme (versions through 1.9.1) for WordPress contains a missing authorization flaw that allows any holder of a valid low-privileged account on an affected site to reach theme functions that perform no capability check, with the primary result being loss of site availability and limited unauthorized content changes. Because this is a widely deployed theme and no vendor fix is available, every WordPress property running it is exposed to disruption by users who would normally have minimal access - including subscriber-level accounts on multi-author, membership, or community sites. Leadership should care because unreachable or degraded public-facing sites translate directly into lost revenue, eroded customer trust, and potential regulatory or contractual exposure, and because remediation currently depends on internal action rather than a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Th Shop Mania theme (versions through 1.9.1) where operationally possible; strictly limit and audit low-privileged WordPress accounts to reduce the pool of potential abusers; front affected sites with WAF or WordPress security tooling to virtually patch and rate-limit requests to theme functionality; enforce continuous monitoring and alerting for site availability and unauthorized content or configuration changes; and maintain verified off-host backups to enable rapid recovery from availability loss. Apply the vendor patch as soon as one is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB