What is the CVSS score of CVE-2026-23974?

CVE-2026-23974 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Theme are affected by CVE-2026-23974?

A critical authorization flaw in uxper Golo versions below 1.7.5 allows attackers to bypass access controls and gain unauthorized access to protected resources.

How to fix or mitigate CVE-2026-23974?

Within 24 hours: Identify all systems running Golo and document their versions; isolate critical Golo instances from untrusted networks if possible. Within 7 days: Implement compensating controls (WAF rules blocking suspicious authorization attempts, network segmentation); contact vendor for patch timeline and interim guidance. Within 30 days: Upgrade to Golo 1.7.5 or later when available; conduct security audit of affected systems for unauthorized access indicators.

Wordpress Theme CVE-2026-23974

MEDIUM

Missing Authorization (CWE-862)

2026-01-22 audit@patchstack.com

WordPress Authentication Bypass Wordpress Theme

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5.

AnalysisAI

Uxper Golo versions prior to 1.7.5 contain an access control bypass that allows authenticated attackers to exploit improperly configured security levels to gain unauthorized access to sensitive functions and data. An attacker with valid credentials can leverage this missing authorization check to escalate privileges and perform administrative actions without proper permission validation. No patch is currently available for this high-severity vulnerability (CVSS 8.8).

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects uxper Golo golo. Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5.