What is the CVSS score of CVE-2026-57797?

CVE-2026-57797 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

EduMall Theme CVE-2026-57797

EUVD-2026-43413 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

Authentication Bypass Edumall WordPress Wordpress Theme

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-exploitable but requires authenticated low-privileged account; impact is limited to low availability with no confidentiality or integrity consequence per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:18 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.

AnalysisAI

Broken access control in ThemeMove's EduMall WordPress theme (versions through 4.5.1) permits authenticated low-privileged users to invoke restricted functionality without proper authorization checks. An attacker with any valid WordPress account can bypass the intended access control tiers and trigger actions that degrade site availability. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a contained, low-severity impact limited to availability.

Technical ContextAI

EduMall is a premium education-focused WordPress theme developed by ThemeMove (CPE: cpe:2.3:a:thememove:edumall:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization), where one or more AJAX handlers, REST API endpoints, or theme-registered hooks within EduMall fail to verify that the authenticated user holds the required WordPress capability before executing a privileged action. WordPress themes commonly register custom endpoints that bypass the core capability model, relying instead on manual nonce and role checks which, when omitted, expose privileged operations to any logged-in user regardless of role (e.g., subscriber, student). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates network-accessible exploitation with low complexity, requiring only low-level authentication.

RemediationAI

Update EduMall to a version released after 4.5.1; no specific patched version number is confirmed in the available data, so administrators should check the ThemeForest changelog or the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/edumall/vulnerability/wordpress-edumall-theme-4-5-0-broken-access-control-vulnerability for the exact fix version before upgrading. As a compensating control pending a patch, restrict site registration to minimize the pool of low-privileged accounts - disabling open user registration via Settings > General eliminates unauthenticated users from obtaining accounts and reduces exposure to trusted users only. Deploying a Web Application Firewall rule (e.g., Patchstack Virtual Patching for WordPress) can block exploitation of the specific endpoint without requiring a theme upgrade, though this may interfere with legitimate theme functionality if the protected endpoint serves normal users. Monitoring WordPress audit logs for unexpected calls to theme AJAX actions from subscriber-level accounts can aid detection.