What is the CVSS score of CVE-2026-57729?

CVE-2026-57729 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Flatsome are affected by CVE-2026-57729?

Flatsome WordPress theme versions 3.20.5 and earlier, deployed across thousands of WooCommerce stores, contains a broken access control vulnerability that exposes sensitive customer and business data…

How to fix or mitigate CVE-2026-57729?

Within 24 hours, identify all systems running Flatsome theme version 3.20.5 or earlier and assess data sensitivity on affected stores. Within 7 days, implement compensating controls including WAF rules to restrict unauthorized access to sensitive endpoints, enable detailed audit logging for all data access attempts, and check vendor advisories for interim updates. Within 30 days, establish monitoring for Flatsome security patches and prepare immediate deployment procedures; upon patch release, apply to all affected instances without delay.

Flatsome CVE-2026-57729

EUVD-2026-43378 HIGH

Missing Authorization (CWE-862)

2026-07-13 Patchstack

Authentication Bypass Flatsome

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote request (AV:N/PR:N/UI:N/AC:L) triggers a missing authorization check exposing sensitive data, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:42 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.

AnalysisAI

Broken access control in the UX-Themes Flatsome WordPress theme (versions up to and including 3.20.5) allows remote unauthenticated attackers to reach functionality or data that should be authorization-gated, resulting in confidentiality-only impact per the CVSS vector. The flaw stems from a missing authorization check (CWE-862) and was catalogued by Patchstack, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Flatsome ≤ 3.20.5

Exploit

Send unauthenticated request to unprotected theme endpoint

Execution

Bypass missing authorization check

Impact

Retrieve exposed sensitive data

Access

Identify WordPress site running Flatsome ≤ 3.20.5

Exploit

Send unauthenticated request to unprotected theme endpoint

Execution

Bypass missing authorization check

Impact

Retrieve exposed sensitive data

Vulnerability AssessmentAI

Exploitation	The target must be a WordPress site running the Flatsome theme at version 3.20.5 or earlier, reachable over the network (AV:N), with the vulnerable theme feature/endpoint active - which is the default for a normally installed and activated theme. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are moderate and partially incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP request directly to the vulnerable Flatsome theme endpoint that lacks an authorization check, and the theme returns or exposes data that should require a privileged session. Given AV:N/AC:L/PR:N/UI:N, no login, no victim interaction, and only a simple request are needed, though as of this analysis no public exploit code has been identified.
Remediation	Upgrade the Flatsome theme to the first release above 3.20.5 that Patchstack/UX-Themes designates as fixed; the exact patched version is not confirmed in the provided data, so verify the current version on the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/flatsome/vulnerability/wordpress-flatsome-theme-3-20-5-broken-access-control-vulnerability-3) and via the UX-Themes update channel before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.