EduMall Theme CVE-2026-57797

Exploitation requires the attacker to hold at minimum a low-privileged WordPress account on the target site (PR:L per CVSS). The vulnerability is present in any WordPress installation running EduMall version 4.5.1 or earlier; no specific non-default configuration or optional feature flag is cited as a prerequisite. What limits exploitation: (1) a valid authenticated session is mandatory - unauthenticated visitors cannot exploit this; (2) impact is constrained to low availability degradation with no confidentiality or integrity consequence; (3) the flaw resides in a premium commercial theme, so exposure is limited to sites that have purchased and installed EduMall. Sites that restrict new user registration to known individuals have a smaller attacker surface than those with open enrollment.

The CVSS base score of 4.3 (Medium) is consistent with the impact profile: no confidentiality or integrity loss, and only low availability degradation. The attack vector is network-accessible and requires no user interaction, lowering the barrier for exploitation. However, PR:L confirms that at minimum a valid WordPress account is required, which significantly reduces the realistic attacker population compared to unauthenticated flaws. EPSS data is not provided; given the niche product footprint and low severity, exploitation probability is presumed low. The vulnerability is not listed in the CISA KEV catalog. No POC exploit code is confirmed in the available data, though Patchstack's advisory database may include technical detail. The 'Authentication Bypass' tag in the report is somewhat misleading given the PR:L CVSS metric - this appears to be privilege escalation within an authenticated session rather than a full authentication bypass. The availability-only impact (A:L) suggests the exploitable action is limited in scope, possibly a denial-of-service via resource exhaustion or forced state reset rather than full site takeover.

An attacker registers a free account on a WordPress site running EduMall (or uses existing credentials as a student/subscriber), then crafts an authenticated HTTP POST request directly to an EduMall-registered AJAX handler or REST endpoint that lacks a capability check. Because the missing authorization gate is never enforced, the request executes a privileged action - such as triggering a bulk operation or clearing a cache - that degrades site responsiveness for other users.