What is the CVSS score of CVE-2026-57776?

CVE-2026-57776 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

VW Wedding CVE-2026-57776

EUVD-2026-43395 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

Authentication Bypass Vw Wedding WordPress Wordpress Theme

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Network-reachable WordPress endpoint with no auth required; impact limited to availability per description and CWE-862 scope, no confidentiality or integrity evidence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:20 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.

AnalysisAI

Broken access control in the VW Wedding WordPress theme (vowelweb) allows unauthenticated remote attackers to exploit incorrectly configured authorization checks, resulting in limited availability impact against affected WordPress installations. All versions through 1.3.7 are affected per the CPE string cpe:2.3:a:vowelweb:vw_wedding. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, placing this in the lower-urgency tier despite network-level reachability.

Technical ContextAI

VW Wedding is a WordPress theme developed by vowelweb, covering wedding-related site presentation functionality. The root cause is CWE-862 (Missing Authorization), meaning the theme fails to perform adequate capability or permission checks before executing certain operations. In WordPress, this class of flaw typically arises when AJAX handlers, REST API endpoints, or admin-ajax actions registered by a theme do not validate whether the calling user holds the necessary role or nonce. The CPE cpe:2.3:a:vowelweb:vw_wedding:*:*:*:*:*:*:*:* confirms the vulnerability spans all tracked versions up to and including 1.3.7. The tag 'Authentication Bypass' from Patchstack suggests at least one code path skips authorization gates entirely, consistent with CWE-862.

RemediationAI

No specific fixed version is identified in the available data; no exact patch version can be cited from the provided references. Site administrators should check the WordPress theme repository or vowelweb's distribution channel for a version newer than 1.3.7 and upgrade immediately if available. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/vw-wedding/vulnerability/wordpress-vw-wedding-theme-1-3-7-broken-access-control-vulnerability should be monitored for patch confirmation. As a compensating control, administrators can temporarily restrict access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) and REST API routes introduced by this theme using a web application firewall (WAF) rule, though this may break theme functionality. Alternatively, deactivating the theme and switching to a maintained alternative eliminates exposure entirely. If the theme cannot be replaced, enabling a WordPress security plugin (e.g., Patchstack, Wordfence) with virtual patching for this CVE provides a temporary mitigation layer.