Open Shop CVE-2026-57405

Exploitation requires an authenticated WordPress account of at least low privilege (CVSS PR:L) on a site running ThemeHunk Open Shop version 1.7.1 or earlier; no user interaction and no elevated/admin role is needed. The limiting factors are the need for a valid account - most impactful on stores that permit open customer/subscriber self-registration - and that the site must run the vulnerable theme version. The exact triggering feature (the specific AJAX/REST/admin-post action missing the authorization check) is not detailed in the available data and should be confirmed against the Patchstack advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) describes a network-reachable, low-complexity issue requiring some authentication (PR:L) and no user interaction, with no confidentiality impact, limited integrity impact, and high availability impact - consistent with an authorization gap that lets a low-privileged account disrupt or alter site state rather than read secrets. Real-world priority is moderate: the PR:L requirement means an attacker needs a valid account (e.g. subscriber/customer on an open-registration store), which meaningfully limits mass exploitation. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation; the score is driven largely by the A:H rating. This looks like a genuine but not emergency-tier issue - patch on a normal cycle unless the site allows open user registration, which raises exposure.

An attacker registers or obtains a low-privileged WordPress account on a site running Open Shop <= 1.7.1, then sends a crafted authenticated request to the theme action that lacks a capability check, invoking privileged functionality. Because integrity and availability are impacted, this can be used to alter site/store data or push the site into a broken or unavailable state. No public POC was provided.