EUVD-2026-41301
GHSA-9g2q-p42j-2pr4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Contributor account required (PR:L), network-accessible with no complexity; only confidentiality impacted as no write or denial-of-service capability is described.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Broken Access Control in Flatsome <= 3.20.5 versions.
AnalysisAI
Broken access control in the Flatsome WordPress theme (versions <= 3.20.5) allows contributor-level authenticated users to access sensitive data they are not authorized to view. The flaw stems from missing authorization checks (CWE-862), enabling privilege escalation beyond the contributor role's intended scope - specifically a high confidentiality impact with no integrity or availability consequence per the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and network-accessible attack vector lower the bar for abuse by any site user holding a contributor account.
Technical ContextAI
Flatsome is a commercial WooCommerce-oriented WordPress theme developed by UX-Themes (CPE: cpe:2.3:a:ux-themes:flatsome:*:*:*:*:*:*:*:*). The vulnerability is classified under CWE-862 (Missing Authorization), meaning the theme performs privileged operations or exposes sensitive data without verifying that the requesting user possesses the required WordPress capability. In WordPress's role hierarchy, the 'Contributor' role is a low-trust role that can draft posts but cannot publish or manage site settings. The absence of a proper capability check allows contributors to reach functionality or data that should be gated at Editor, Administrator, or higher levels. This is a common theme/plugin vulnerability class in the WordPress ecosystem, often arising from REST API endpoints, AJAX handlers, or shortcode processors that omit nonce validation and capability checks.
RemediationAI
Update the Flatsome theme to a version above 3.20.5 immediately; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/flatsome/vulnerability/wordpress-flatsome-theme-3-20-5-broken-access-control-vulnerability-2 should be consulted for the exact patched release version, which is not explicitly stated in currently available data. If an immediate update is not feasible, restrict the Contributor role to trusted users only and audit all accounts holding that role or higher for legitimacy. As a compensating control, consider temporarily removing contributor-level access from non-essential accounts until the patch is applied - note this may affect multi-author workflows. Disabling user registration if the site does not require it (Settings > General > Membership in WordPress) eliminates the self-registration pathway that would allow an attacker to create their own contributor account. No integrity or availability impact was identified, so the primary concern to mitigate is unauthorized data read access.
Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.17.5.
Broken access control in the UX-Themes Flatsome WordPress theme (versions up to and including 3.20.5) allows remote unau
Reflected cross-site scripting in the UX-themes Flatsome WordPress/WooCommerce theme (all versions up to and including 3
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Vid
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Insufficient authorization controls in Flatsome theme versions 3.19.6 and earlier allow unauthenticated remote attackers
Broken access control in Flatsome WordPress theme versions 3.20.5 and earlier allows authenticated subscriber-level user
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today