What is the CVSS score of CVE-2026-57730?

CVE-2026-57730 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Flatsome Theme CVE-2026-57730

EUVD-2026-41300 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-5wj4-4cxx-q463

WordPress Authentication Bypass Flatsome Wordpress Theme Ux Themes

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L confirmed by 'Subscriber' in title; C:L only as no integrity or availability impact is described; AV:N and AC:L per network-accessible WordPress AJAX pattern.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:32 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.

AnalysisAI

Broken access control in Flatsome WordPress theme versions 3.20.5 and earlier allows authenticated subscriber-level users to access restricted resources or perform actions beyond their intended authorization. The flaw stems from missing authorization checks (CWE-862) on one or more endpoints or actions within the theme, enabling low-privilege WordPress users to retrieve information they should not be permitted to view. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is limited to authenticated users, reducing opportunistic risk.

Technical ContextAI

Flatsome is a multipurpose WooCommerce WordPress theme developed by UX-Themes (CPE: cpe:2.3:a:ux-themes:flatsome:*:*:*:*:*:*:*:*). The vulnerability is classified under CWE-862 (Missing Authorization), which occurs when code exposes a function, endpoint, or AJAX action without validating whether the requesting user holds the required capability or role. In WordPress themes, this commonly manifests as unprotected admin-ajax.php handlers or REST API endpoints that check only for authentication (i.e., is the user logged in?) without verifying the user's role or capability (i.e., is the subscriber allowed to perform this action?). The CVSS vector confirms network delivery, low complexity, and low-privilege access required, with confidentiality-only impact - consistent with unauthorized read access to restricted theme settings, order data, or configuration values.

RemediationAI

Update the Flatsome theme to a version released after 3.20.5, which should contain the authorization fix per Patchstack's disclosure at https://patchstack.com/database/wordpress/theme/flatsome/vulnerability/wordpress-flatsome-theme-3-20-5-broken-access-control-vulnerability?_s_id=cve. The exact patched version number has not been independently confirmed from the provided data - verify the changelog on the ThemeForest product page or UX-Themes support portal before deploying. As a compensating control pending upgrade, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts; note this will break WooCommerce customer self-registration if enabled. Additionally, a Web Application Firewall rule restricting unauthenticated and low-privilege access to sensitive AJAX endpoints can reduce exposure, though the specific vulnerable endpoint is not identified in available data.