What is the CVSS score of CVE-2026-22343?

CVE-2026-22343 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of WordPress Dating Theme are affected by CVE-2026-22343?

PremiumPress WordPress Dating Theme (versions ≤11.2.0) contains an unauthenticated access control flaw allowing remote attackers to bypass authorization and reach restricted member or administrative…

How to fix or mitigate CVE-2026-22343?

Within 24 hours: Inventory all WordPress installations using PremiumPress Dating Theme; document affected versions and asset criticality. Within 7 days: Implement Web Application Firewall rules restricting unauthenticated access to restricted endpoints; review access logs for suspicious activity; engage PremiumPress support for security guidance and patch timeline. Within 30 days: Deploy patched version when released by vendor or migrate to alternative secure theme; conduct forensic audit of member databases to identify unauthorized access; notify members of data exposure if confirmed.

WordPress Dating Theme CVE-2026-22343

EUVD-2026-37662 HIGH

Missing Authorization (CWE-862)

2026-06-17 Patchstack

WordPress Authentication Bypass Wordpress Dating Theme Wordpress Theme

8.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

8.6 HIGH

Unauthenticated network-reachable authorization bypass (AV:N/AC:L/PR:N/UI:N); high confidentiality from member-data exposure, with limited integrity/availability matching a read-leaning broken access control flaw.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:29 vuln.today

CVE Published

Jun 17, 2026 - 09:50 cve.org

HIGH 8.6

DescriptionCVE.org

Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.

AnalysisAI

Unauthenticated broken access control in PremiumPress WordPress Dating Theme through version 11.2.0 allows remote attackers to reach restricted functionality without credentials, resulting in high confidentiality impact and limited integrity and availability impact. The flaw was disclosed via Patchstack and currently has no public exploit identified at time of analysis, but the network-reachable, no-interaction vector (AV:N/AC:L/PR:N/UI:N) makes opportunistic abuse against exposed sites realistic. No CISA KEV listing or EPSS score is provided in the input.

Technical ContextAI

The affected component is the PremiumPress 'WordPress Dating Theme' (CPE cpe:2.3:a:premiumpress_limited.:wordpress_dating_theme), a commercial WordPress theme that ships its own profile, messaging, and member-area handlers on top of the WordPress plugin/theme framework. The root cause is CWE-862 (Missing Authorization): one or more theme endpoints - typically AJAX actions, REST routes, or admin-post handlers - execute privileged logic without calling current_user_can() or an equivalent capability check, so the access decision is left to obscurity of the URL rather than to WordPress's capability system. Because WordPress themes run in-process with core, any unauthorized handler effectively inherits the site's data access, which is why the impact is scored against the whole site rather than a sandboxed component.

RemediationAI

Patch available per vendor advisory: upgrade the WordPress Dating Theme to a release later than 11.2.0 as referenced in the Patchstack entry (https://patchstack.com/database/wordpress/theme/da10/vulnerability/wordpress-wordpress-dating-theme-theme-11-2-0-broken-access-control-vulnerability); the exact fixed version is not stated in the input data, so confirm the target version directly with PremiumPress before deploying. Until the upgrade is rolled out, the most useful compensating controls are: deploying Patchstack's or another WAF's virtual patch rule for this CVE (trade-off: depends on signature accuracy and may break legitimate AJAX flows), blocking unauthenticated access to the theme's AJAX/REST endpoints at the reverse proxy by requiring a valid WordPress login cookie on /wp-admin/admin-ajax.php and /wp-json/ paths owned by the theme (trade-off: will break any front-end feature that legitimately calls those endpoints without login, such as public profile browsing), and temporarily switching to a default WordPress theme on non-production sites for triage (trade-off: loss of site functionality and branding). Audit access logs for anomalous hits against theme-specific endpoints during the exposure window.