What is the CVSS score of CVE-2026-57729?

CVE-2026-57729 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Flatsome are affected by CVE-2026-57729?

Flatsome WordPress theme versions 3.20.5 and earlier, deployed across thousands of WooCommerce stores, contains a broken access control vulnerability that exposes sensitive customer and business data…

How to fix or mitigate CVE-2026-57729?

Within 24 hours, identify all systems running Flatsome theme version 3.20.5 or earlier and assess data sensitivity on affected stores. Within 7 days, implement compensating controls including WAF rules to restrict unauthorized access to sensitive endpoints, enable detailed audit logging for all data access attempts, and check vendor advisories for interim updates. Within 30 days, establish monitoring for Flatsome security patches and prepare immediate deployment procedures; upon patch release, apply to all affected instances without delay.

Flatsome CVE-2026-57729

EUVD-2026-43378 HIGH

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Flatsome Wordpress Theme Ux Themes

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote request (AV:N/PR:N/UI:N/AC:L) triggers a missing authorization check exposing sensitive data, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:42 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.

AnalysisAI

Broken access control in the UX-Themes Flatsome WordPress theme (versions up to and including 3.20.5) allows remote unauthenticated attackers to reach functionality or data that should be authorization-gated, resulting in confidentiality-only impact per the CVSS vector. The flaw stems from a missing authorization check (CWE-862) and was catalogued by Patchstack, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Flatsome is one of the most widely sold commercial WooCommerce themes, so the affected footprint is substantial even though only information disclosure (not integrity or availability) is implicated.

Technical ContextAI

Flatsome is a premium multipurpose WordPress/WooCommerce theme distributed by UX-Themes and identified by the CPE cpe:2.3:a:ux-themes:flatsome. The root cause is CWE-862 (Missing Authorization): a theme endpoint, AJAX action, or feature performs a sensitive operation without verifying that the requesting user holds the required capability or role. In WordPress themes this class of bug typically arises when an admin-ajax.php action, REST route, or theme handler is registered for both privileged and unprivileged (nopriv) contexts, or omits a current_user_can() / nonce check entirely. The Patchstack advisory characterizes it as 'Exploiting Incorrectly Configured Access Control Security Levels,' consistent with an access-control tier being set too permissively rather than a code-injection or memory-safety defect. The CVSS impact profile (C:H/I:N/A:N) indicates the exposed operation leaks sensitive data rather than allowing writes or service disruption.

RemediationAI

Upgrade the Flatsome theme to the first release above 3.20.5 that Patchstack/UX-Themes designates as fixed; the exact patched version is not confirmed in the provided data, so verify the current version on the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/flatsome/vulnerability/wordpress-flatsome-theme-3-20-5-broken-access-control-vulnerability-3) and via the UX-Themes update channel before deploying. Because Flatsome is a paid theme updated through the vendor rather than the wordpress.org repository, ensure the theme license/registration is active so the update is offered. If you cannot patch immediately, apply compensating controls: place a WAF or virtual patch (Patchstack offers one for this CVE) in front of the site to block requests to the vulnerable theme endpoint; restrict access to the affected admin-ajax.php action or REST route at the web-server or WAF layer (trade-off: may break legitimate front-end AJAX features that depend on that action, so test first); and monitor access logs for anomalous unauthenticated requests to theme handlers. Avoid disabling the theme wholesale unless a maintenance window allows, since that takes the storefront offline.