What is the CVSS score of CVE-2026-27435?

CVE-2026-27435 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-27435?

Yes, a patch is available for CVE-2026-27435. Update the affected software to the latest version immediately.

Woffice CVE-2026-27435

EUVD-2026-40940 MEDIUM

Missing Authorization (CWE-862)

2026-07-01 Patchstack

GHSA-xw5j-5p2q-fr86

WordPress Authentication Bypass Woffice Wordpress Theme

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint with no credential or interaction requirement (PR:N/UI:N); impact confined to low integrity writes with no confidentiality or availability consequence, consistent with CWE-862 broken access control.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 11:16 EUVD

Analysis Generated

Jul 01, 2026 - 09:51 vuln.today

CVE Published

Jul 01, 2026 - 08:50 cve.org

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Woffice: from n/a before 5.4.33.

AnalysisAI

Broken access control in the WofficeIO Woffice WordPress theme (all versions before 5.4.33) permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, achieving low-impact unauthorized write actions without credentials or user interaction. Discovered and disclosed by Patchstack, the flaw stems from CWE-862 (Missing Authorization), where the theme fails to enforce proper capability checks on specific endpoints. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated and low-complexity attack vector broadens the exposure surface beyond what the medium CVSS score alone conveys.

Technical ContextAI

Woffice is a premium WordPress intranet and extranet theme developed by WofficeIO (CPE: cpe:2.3:a:wofficeio:woffice:*:*:*:*:*:*:*:*). CWE-862 (Missing Authorization) describes a class of flaw where an application performs authentication but omits - or incorrectly implements - the subsequent step of verifying whether the authenticated or anonymous user is actually authorized to perform a requested action. In the WordPress security model, themes and plugins are expected to use capability checks (e.g., current_user_can()) before executing privileged operations. The Patchstack advisory title references version 5.4.31 as the context of discovery, suggesting the flaw existed across a range of releases preceding the 5.4.33 fix. The tag 'Authentication Bypass' alongside CWE-862 indicates the absence of access control checks allows lower-privileged or unauthenticated users to invoke functionality reserved for higher-privilege roles.

RemediationAI

Update the Woffice WordPress theme to version 5.4.33 or later, which resolves the missing authorization flaw per the NVD description. Updates can be applied through the WordPress admin dashboard under Appearance > Themes or via WP-CLI (wp theme update woffice) without service disruption. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/woffice/vulnerability/wordpress-woffice-theme-5-4-31-broken-access-control-vulnerability?_s_id=cve for additional guidance. If an immediate upgrade is not feasible, consider deploying a Web Application Firewall (WAF) rule - such as Patchstack's virtual patching or Wordfence - to block unauthorized requests to the affected theme endpoints as a temporary compensating control; note this does not fix the underlying code and may interfere with legitimate theme functionality if not scoped carefully. Restricting public internet access to the WordPress admin and theme-specific REST/AJAX endpoints via web server configuration (e.g., IP allowlisting) is an additional compensating measure with the trade-off of limiting legitimate remote access.