What is the CVSS score of CVE-2026-57689?

CVE-2026-57689 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Werkstatt Theme CVE-2026-57689

EUVD-2026-41298 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-69q5-h2w4-49j7

Authentication Bypass Werkstatt WordPress Wordpress Theme

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Subscriber authentication required (PR:L) with network delivery; impact is confidentiality-only read access (C:L), no integrity or availability consequence confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:33 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

AnalysisAI

Broken access control in the Werkstatt WordPress theme (Fuelthemes) versions 4.7.2 and below allows subscriber-level authenticated users to access functionality or data restricted to higher-privileged roles. The root cause is missing authorization checks (CWE-862), permitting low-privilege WordPress accounts to bypass intended access restrictions and read protected information. No public exploit code is identified and the vulnerability is not listed in CISA KEV, but the low-complexity network vector makes it trivially exploitable by any subscriber-level user on affected sites.

Technical ContextAI

Werkstatt is a WordPress theme developed by Fuelthemes (CPE: cpe:2.3:a:fuelthemes:werkstatt:*:*:*:*:*:*:*:*). CWE-862 (Missing Authorization) indicates that one or more theme functions - likely AJAX handlers, REST API endpoints, or admin-facing actions - fail to invoke WordPress capability checks such as current_user_can() before executing privileged operations. In WordPress, the subscriber role is the lowest authenticated role, possessing only the ability to read published content. When theme code omits capability verification, subscribers can invoke actions intended solely for editors, administrators, or other elevated roles. This class of vulnerability is prevalent in third-party WordPress themes and plugins that register custom hooks without enforcing role-based access controls.

RemediationAI

Upgrade the Werkstatt theme to a version above 4.7.2 via the WordPress dashboard or by downloading the latest release from the theme vendor. The exact patched version number is not independently confirmed in the available data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/werkstatt/vulnerability/wordpress-werkstatt-theme-4-7-2-broken-access-control-vulnerability and the Fuelthemes official theme repository for the current fixed release. As a compensating control while patching, administrators should disable open user registration under Settings > General by unchecking 'Anyone can register', which prevents attackers from self-provisioning subscriber accounts. Additionally, audit the subscriber user list and remove any unknown or unnecessary accounts. The trade-off of disabling registration is loss of any legitimate self-service signup flow the site relies on.