What is the CVSS score of CVE-2026-27433?

CVE-2026-27433 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Motors Theme CVE-2026-27433

EUVD-2026-41337 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-fmc6-6rcg-62mh

Authentication Bypass Motors WordPress Wordpress Theme

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

AV:N/PR:N confirmed by unauthenticated network-accessible AJAX handler; C:N because no data exposure is described; I:L and A:L match unauthorized modification and limited disruption impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:37 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.

AnalysisAI

Broken access control in the Motors WordPress theme (by StyleMixThemes) versions 5.6.80 and earlier allows unauthenticated remote attackers to perform unauthorized actions, resulting in limited integrity and availability impact without requiring any credentials or user interaction. The vulnerability stems from CWE-862 (Missing Authorization), where specific theme functionality fails to enforce permission checks before executing sensitive operations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack profile makes opportunistic exploitation straightforward for any threat actor targeting WordPress installations.

Technical ContextAI

The Motors theme (CPE: cpe:2.3:a:stylemixthemes:motors:*:*:*:*:*:*:*:*) is a commercial WordPress theme by StyleMixThemes targeting automotive dealerships and car rental businesses. The root cause is CWE-862 (Missing Authorization): one or more theme endpoints or AJAX handlers execute privileged operations without verifying whether the requesting user has the right to do so. In WordPress, this typically manifests as theme or plugin functions hooked to 'wp_ajax_nopriv_' actions - which are accessible to unauthenticated users - that perform state-changing operations without a capability check (e.g., current_user_can()). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms the flaw is network-reachable, requires no authentication, and can be triggered without victim interaction, consistent with a missing nonce or capability gate on a publicly exposed HTTP handler.

RemediationAI

The primary remediation is to update the Motors theme to a version released after 5.6.80 - the exact patched version is not independently confirmed in the available intelligence data, but the Patchstack advisory at https://patchstack.com/database/wordpress/theme/motors/vulnerability/wordpress-motors-theme-5-6-80-broken-access-control-vulnerability should be consulted for the confirmed fix version. Site administrators should update through the WordPress admin dashboard or ThemeForest. As a compensating control pending patch application, deploying a Web Application Firewall (WAF) with WordPress-aware rulesets (e.g., Patchstack, Wordfence, or Cloudflare) can block exploitation attempts at the network layer with no functional side effects. Restricting unauthenticated access to wp-admin/admin-ajax.php via server-side rules is a second option but may break legitimate frontend functionality that depends on AJAX; test in staging before applying. There is no known viable workaround that fully mitigates the missing authorization check without patching the theme code itself.