What is the CVSS score of CVE-2026-31915?

CVE-2026-31915 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Flatsome are affected by CVE-2026-31915?

Organizations using Missing Authorization vulnerability in UX-themes Flatsome flatsome should be aware of moderate risk from CVE-2026-31915, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-31915?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Flatsome CVE-2026-31915

EUVD-2026-11788 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Flatsome

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11788

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:41 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.19.6.

AnalysisAI

Insufficient authorization controls in Flatsome theme versions 3.19.6 and earlier allow unauthenticated remote attackers to modify data through improperly configured access restrictions. The vulnerability enables unauthorized modifications without requiring user interaction, potentially compromising content integrity across affected websites.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a class of access control defects where the application fails to properly verify user permissions before granting access to sensitive operations. In the context of the Flatsome theme (CPE identifiable as a WordPress theme component within WooCommerce/WordPress ecosystem), the flaw manifests as incorrectly configured access control security levels that allow unauthenticated or insufficiently privileged users to perform content modification operations. WordPress themes typically rely on WordPress's built-in capability system (wp_current_user(), current_user_can()), nonce verification, and role-based access control; this vulnerability indicates the Flatsome theme failed to properly implement one or more of these authorization checks in its custom functionality, potentially in AJAX endpoints, REST API routes, or theme-specific admin operations.

RemediationAI

Immediately upgrade the Flatsome theme to version 3.19.7 or later via WordPress Admin Dashboard (Appearance > Themes > Flatsome > Update if available), or download the patched version directly from the UX-themes store/marketplace. Verify the update was successful by confirming the version number in theme settings. As an interim measure on systems where immediate patching is not feasible, restrict WordPress administrative and content editing access to trusted IP ranges via firewall or .htaccess rules, disable REST API endpoints if not required (add define('REST_API_ENABLED', false); to wp-config.php), and audit user roles/capabilities to ensure only necessary accounts have content modification permissions. Monitor WordPress audit logs (via security plugins like Wordfence or Sucuri) for unauthorized modification attempts while the patch is being deployed.