Golo CVE-2026-27051

No special conditions — remote unauthenticated exploitation against default installations of uxper Golo versions 1.7.0 and earlier. CVSS vector indicates direct network access with no authentication or user interaction required.

Despite the absence of CVSS scoring and EPSS probability data, this vulnerability presents a meaningful real-world risk given its nature as a privilege escalation flaw in a publicly distributed WordPress theme. The lack of a CVSS vector prevents quantitative comparison against other CVEs; however, privilege escalation vulnerabilities—particularly in WordPress themes with wide distribution—are historically high-priority targets. The absence of KEV (Known Exploited Vulnerability) status and EPSS data does not diminish the threat; rather, it suggests either recent discovery or limited public exploitation documentation. The vulnerability's automation potential is moderate: while privilege escalation requires initial access to the WordPress application, the exploitation likely requires minimal attacker interaction once the flawed logic is identified. Organizations relying on Golo theme versions through 1.7.0 should prioritize assessment and patching, as this class of flaw is frequently the initial foothold for lateral movement and full site compromise.

An attacker with a low-privilege WordPress account (e.g., Contributor or Subscriber role) could exploit the Golo theme's improper privilege assignment logic by submitting a crafted request that bypasses the theme's authorization checks, allowing them to escalate their role to Administrator. Once elevated, the attacker gains full site access, can install malicious plugins, modify theme files, exfiltrate sensitive data, or inject backdoors for persistent access. The attack requires only network access to the WordPress instance and a valid user account; no complex exploitation tools or advanced technical skills are necessary once the specific privilege escalation vector is identified.