Astra WordPress Theme CVE-2026-27085

Requires an authenticated account with the WooCommerce 'Shop Manager' role (PR:H) on a WordPress site running the Astra theme at version 4.13.12 or earlier; the presence of the Shop Manager role further implies WooCommerce must be installed and active. Exploitation is network-reachable with low complexity and no user interaction needed to inject (UI:N), but the high privilege requirement - a trusted store-management account - is the primary limiting factor, confining realistic abuse to malicious insiders or attackers who have already compromised such an account. Impact is limited to integrity (content/markup injection); no confidentiality or availability impact.

This is a low-priority issue despite affecting a very widely deployed product. The CVSS 3.1 base score is 2.7 (Low), driven by PR:H (requires an authenticated high-privilege account - a WordPress Shop Manager role, which implies WooCommerce is installed) and an impact limited to I:L with no confidentiality or availability impact (C:N/A:N). CWE-80 (basic XSS via HTML tag injection) combined with the vector points to stored/reflected content injection that a Shop Manager could plant, but the attacker already needs a trusted, privileged account, sharply limiting real-world abuse to insider or post-compromise scenarios. No EPSS score, KEV listing, or public POC was provided, so exploitation is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector (AV:N/AC:L/PR:H/UI:N) and the description - both agree on an authenticated, network-reachable, low-integrity content-injection flaw. The only nuance is that the Patchstack tag labels this 'XSS' while the title says 'Content Injection'; CWE-80 spans both and the practical effect is script/markup injection, so the risk is a self- or peer-targeted XSS payload rather than a system compromise. Net: real but minor, patch during routine maintenance.

An authenticated user holding the WooCommerce Shop Manager role submits crafted input into an Astra theme field that is rendered without adequate sanitization, injecting HTML/script that executes when another user or admin views the affected page. Because the attacker must already hold a privileged store-management account (PR:H), the realistic scenario is a malicious or compromised Shop Manager escalating influence or phishing higher-privileged admins. No public proof-of-concept was identified at the time of analysis.