What is the CVSS score of CVE-2026-57779?

CVE-2026-57779 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Fascinate Theme CVE-2026-57779

EUVD-2026-43397 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

Authentication Bypass Fascinate WordPress Wordpress Theme

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Endpoint reachable over network with no auth (AV:N/PR:N); impact is write-only with no data exposure or availability loss, consistent with a broken access control allowing unauthorized modifications.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:19 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.

AnalysisAI

Unauthenticated broken access control in the Fascinate WordPress theme by themebeez (versions through 1.1.5) permits remote attackers to exploit incorrectly configured capability checks, resulting in unauthorized write-level actions on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, with impact limited to integrity (I:L). No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) indicates that the theme registers one or more WordPress hooks - typically AJAX handlers, REST API endpoints, or admin-post callbacks - without performing the required capability checks (e.g., current_user_can()) before executing sensitive operations. WordPress's access control model relies on themes and plugins explicitly gating privileged functionality; omitting these checks allows any HTTP client to invoke restricted logic. The affected product is identified via CPE cpe:2.3:a:themebeez:fascinate as the Fascinate theme distributed by themebeez, covering all versions up to and including 1.1.5.

RemediationAI

Check for a Fascinate theme update beyond version 1.1.5 via the WordPress admin dashboard (Appearance > Themes > Update) or directly from the themebeez distribution channel. No specific patched version is confirmed in the available input data - verify the current release version against the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/fascinate/vulnerability/wordpress-fascinate-theme-1-1-5-broken-access-control-vulnerability before deploying. If no patch is available or upgrade is not immediately possible, consider switching to a non-vulnerable theme temporarily, or use a WordPress firewall plugin (e.g., Patchstack, Wordfence) to virtually patch the vulnerable endpoints - note this adds a dependency on the WAF rule accuracy. Deactivating the theme is the most reliable compensating control but will affect site appearance.