What is the CVSS score of CVE-2026-57405?

CVE-2026-57405 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Open Shop are affected by CVE-2026-57405?

ThemeHunk Open Shop WordPress theme versions up to 1.7.1 contain a broken access control vulnerability (CVSS 7.1) that allows authenticated low-privilege users to execute restricted administrative…

How to fix or mitigate CVE-2026-57405?

Within 24 hours, audit all WordPress installations to identify those running ThemeHunk Open Shop theme version 1.7.1 or earlier and document current low-privilege user accounts and their permissions. Within 7 days, implement role-based access restrictions to prevent low-privilege users from accessing sensitive administrative functions, enable comprehensive audit logging on privileged actions, and consider disabling affected theme features if operationally feasible. Within 30 days, evaluate migration to an alternative WordPress theme without this vulnerability, establish monitoring of Patchstack and ThemeHunk security advisories for patch release, and deploy Web Application Firewall rules to restrict privileged action execution by non-administrative users.

Open Shop CVE-2026-57405

EUVD-2026-43476 HIGH

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Open Shop Wordpress Theme Themehunk

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Network-reachable action needs an authenticated low-privileged account (PR:L) with no interaction; missing authorization yields limited integrity tampering (I:L) and high availability disruption (A:H), no data disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:58 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Shop: from n/a through <= 1.7.1.

AnalysisAI

Broken access control in the ThemeHunk Open Shop WordPress theme (versions up to and including 1.7.1) lets an authenticated low-privileged user reach functionality that should be restricted, tampering with data and degrading site availability. Reported by Patchstack and rated CVSS 7.1, the flaw stems from missing authorization checks on a privileged action. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Open Shop e-commerce/storefront theme published by ThemeHunk for the WordPress platform (CPE cpe:2.3:a:themehunk:open_shop:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): a server-side action or endpoint fails to verify that the caller holds the required capability/role before executing, an example of 'Incorrectly Configured Access Control Security Levels'. In WordPress themes this class of bug typically appears in AJAX handlers, REST routes, or admin-post actions that check that a user is logged in (nonce present) but never confirm the user's capability, so any authenticated account can invoke operator-level functionality.

RemediationAI

No vendor-released patch version was identified at time of analysis; the input does not name a fixed release. Monitor the ThemeHunk changelog and the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/open-shop/vulnerability/wordpress-open-shop-theme-1-7-1-broken-access-control-vulnerability?_s_id=cve) and upgrade to the first release above 1.7.1 as soon as it is published. As compensating controls until a patch is applied, disable open user self-registration (Settings > General > 'Anyone can register') to eliminate the low-privileged account prerequisite - trade-off: blocks legitimate customer sign-ups on storefronts; deploy a WAF/virtual-patch rule (Patchstack provides one) to block the vulnerable action; and audit and remove untrusted low-privilege accounts. Where the theme is not essential, switching to a maintained theme removes the exposure entirely.