EUVD-2026-96442
GHSA-5g75-fv5c-63hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site using Grand News theme
-
ExploitSend crafted request to unprotected action
-
ExecutionBypass missing authorization check
-
ImpactPerform unauthorized state-changing operation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the ThemeGoods Grand News theme at version 3.4 or earlier; exploitation requires network access to the site over HTTP(S). No authentication (PR:N) and no user interaction (UI:N) are required, so default installations are exploitable without special configuration. The input does not name the specific vulnerable feature, parameter, or action lacking the authorization check, so the precise trigger could not be extracted from the description. The primary limiting factor is deployment: only sites that have installed this specific theme are affected, and impact is confined to unauthorized integrity changes (C:N/A:N), not data theft or denial of service. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which justifies the 7.5 base score, but the impact profile is narrow: C:N/I:H/A:N means the vulnerability permits unauthorized modification (integrity) only, with no data disclosure or availability loss - consistent with CWE-862 Missing Authorization on a state-changing action. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The absence of an exploitation-probability signal (EPSS) and of SSVC data means automatability and real-world exploitation volume cannot be assessed from the input and must be verified separately. Net: this is a genuinely easy-to-reach, pre-auth integrity flaw and should be patched, but the lack of KEV/POC/EPSS signals and the limited (integrity-only, scope-unchanged) impact argue against treating it as an emergency relative to confidentiality- or RCE-class issues; prioritize based on deployment footprint of the Grand News theme. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request directly to a sensitive theme action on a WordPress site running Grand News <= 3.4 that fails to enforce an authorization/capability check. Because no authentication or user interaction is required, the attacker invokes the privileged function to alter site state (integrity impact). No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated attackers can abuse missing authorization checks in the ThemeGoods Grand News WordPress theme (versions 3.4 and earlier) to carry out state-changing actions they should not be permitted to perform, modifying site integrity without valid credentials or any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable, low-complexity, and unauthenticated, but its impact is deliberately narrow: integrity only, with no data disclosure or availability loss. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Because the input provides no fixed version, the most reliable mitigation is to deactivate and remove the Grand News theme (version 3.4 or earlier) from affected sites and replace it with a maintained theme; note that this changes the site's presentation layer and requires re-validating any theme-specific templates or customizations. If the theme cannot be removed immediately, apply compensating controls: place the site behind a WAF with virtual patching that blocks unauthenticated requests to the theme's state-changing AJAX/REST/admin-post endpoints (trade-off: WAF rules are signature-based and may break legitimate front-end features if the protected endpoint is used by anonymous visitors), and restrict those endpoints to authenticated users holding the appropriate capability where the deployment allows it. Keep WordPress and all themes/plugins current, continuously audit logs and file-integrity monitoring for unexpected content or option changes, and monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/grandnews/vulnerability/wordpress-grand-news-theme-3-4-broken-access-control-vulnerability?_s_id=cve for a vendor-issued fixed release, then upgrade to that exact version as soon as it is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a missing authorization (CWE-862) defect in the ThemeGoods Grand News theme, identified in CPE data as cpe:2.3:a:themegoods:grand_news. WordPress themes commonly expose state-changing operations through admin-ajax.php actions, REST API routes, or admin-post handlers; a missing authorization flaw means such an operation can be reached and executed by an unauthenticated visitor because the expected capability check (for example current_user_can()) and/or nonce validation is absent or insufficient. The supplied data does not name the specific vulnerable feature, parameter, or action that lacks the check, so the exact trigger cannot be confirmed from the description alone; what is confirmed is the vector profile - network-reachable (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), unchanged scope (S:U) - with impact confined to integrity (I:H) and neither confidentiality (C:N) nor availability (A:N). That profile is consistent with an attacker invoking a privileged state-changing routine directly rather than exploiting memory corruption or exfiltrating data.
Know when Grand News gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated, network-reachable missing authorization (PR:N, AV:N, AC:L, UI:N) allowing unauthorized state change, so I:H with C:N/A:N and scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
Executive ViewAI
The ThemeGoods Grand News WordPress theme, versions 3.4 and earlier, contains a missing authorization vulnerability that allows unauthenticated attackers to modify site integrity. Organizations using this theme on their public-facing WordPress sites are at risk of content tampering, defacement, or injection of malicious elements, which could damage brand reputation and user trust. Leadership should prioritize remediation because the flaw is network-reachable, requires no credentials or user interaction, and currently has no vendor-released patch; no public exploit identified at time of analysis.
Interim mitigations include deactivating or removing the ThemeGoods Grand News theme (versions 3.4 and earlier) if not essential; deploying WAF rules to block unauthenticated state-changing requests targeting the theme; enabling file integrity monitoring and regular content audits; restricting access to WordPress admin interfaces; and migrating to an alternative, actively maintained theme. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB