EUVD-2026-43394Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Missing authorization in a WordPress theme plausibly enables unauthorized modification of theme settings (I:L), not just availability; C:N as no data exposure is indicated.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.
AnalysisAI
Missing authorization controls in the VW Food Corner WordPress theme (versions through 1.1.0) permit unauthenticated remote attackers to invoke restricted theme functionality without valid access credentials, resulting in availability impact. Reported by Patchstack and classified under CWE-862, the flaw stems from incorrectly configured access control levels that fail to verify caller identity or capability before executing protected actions. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Technical ContextAI
VW Food Corner is a WordPress theme developed by vowelweb, targeting restaurant and food-service websites, identified by CPE cpe:2.3:a:vowelweb:vw_food_corner:*:*:*:*:*:*:*:*. The root cause class is CWE-862 (Missing Authorization), which in the WordPress ecosystem typically manifests as AJAX action handlers or REST API endpoints registered without corresponding capability checks - for example, omitting current_user_can() gates or nonce validation before processing privileged operations. The 'Authentication Bypass' tag from Patchstack indicates that the authorization barrier is entirely absent rather than merely weak, allowing the WordPress permission model to be sidestepped. The constrained CVSS impact profile (C:N/I:N/A:L) suggests the exposed, unguarded functionality is limited in scope - likely a theme settings reset, a resource-intensive rendering call, or a similar availability-affecting action rather than a data-disclosure or content-modification pathway.
RemediationAI
No confirmed patched release version has been independently verified from the available data - site operators should check the WordPress.org theme repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/vw-food-corner/vulnerability/wordpress-vw-food-corner-theme-1-1-0-broken-access-control-vulnerability for an updated release beyond 1.1.0. As an immediate compensating control, administrators can deactivate the VW Food Corner theme and substitute an alternative until a fixed version is confirmed available, eliminating the attack surface entirely. Deploying a WordPress-level WAF such as Patchstack MU Plugin or Wordfence with virtual patching rules can block unauthenticated requests targeting the vulnerable endpoints without requiring theme deactivation, though WAF rule coverage for this specific flaw must be verified with the WAF vendor. Restricting unauthenticated access to wp-admin/admin-ajax.php and wp-json REST endpoints at the web server layer (via nginx location blocks or Apache mod_rewrite) can reduce exposure but may break legitimate theme front-end functionality and should be tested in a staging environment first.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today