Starter Templates CVE-2026-39721

Exploitation requires an authenticated account with at least low privileges on the target WordPress site (CVSS PR:L), meaning the attacker must already be a registered user such as a subscriber; it cannot be performed by a fully unauthenticated visitor. The flaw is an incorrectly configured access-control level on a Starter Templates plugin function (versions through 4.7.7), so the limiting factors are the need for valid low-privilege credentials, open user registration or otherwise obtainable accounts, and the plugin being installed and active. No user interaction is needed and the attack is remote over the network with low complexity, but impact is constrained to low integrity and availability effects with no confidentiality loss.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Starter Templates (astra-sites) WordPress plugin, scored CVSS 5.4. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) describes a network-reachable, low-complexity issue that requires an authenticated attacker holding at least low privileges (PR:L), with no user interaction, producing only low integrity and availability impact and no confidentiality impact. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input; per the precision rules this is 'no public exploit identified at time of analysis,' and the absence of KEV means there is no evidence of active exploitation. The practical risk is best characterized as a privilege/access-control gap exploitable by existing low-privileged users (e.g., subscriber/contributor-level accounts) rather than a remote-unauthenticated takeover: the C:N/I:L/A:L impact profile and PR:L requirement keep this well below critical. Weigh this against the plugin's very large install base - the broad deployment footprint raises aggregate exposure even though the per-instance impact is limited. No conflicting signals were observed between the CVSS vector and the description, though the exact affected functionality and the privilege level that triggers the flaw are not detailed in the source and should be confirmed with the Patchstack advisory.

An attacker who already holds a low-privileged authenticated account (such as a subscriber) on a WordPress site running Starter Templates ≤4.7.7 sends a request to a plugin endpoint that fails to verify authorization, performing an action or modifying data they should not have access to. No user interaction is required and the attack is network-based with low complexity, but it is bounded by the need for a valid low-privilege account and yields only limited integrity/availability impact. No public proof-of-concept was identified in the provided data.