Civi WordPress Theme CVE-2026-65476

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation. The target WordPress site must have the Civi theme active (not merely installed) and running version 2.2.4 or earlier. The vulnerable functionality is network-accessible over standard HTTP/HTTPS with no special network positioning needed (AV:N, AC:L). Exploitation is limited to integrity impact only - an attacker cannot read confidential data or cause availability disruption based on the CVSS scoring. The specific theme feature or AJAX/REST action containing the missing authorization check is not named in the available data, so the exact exploitable endpoint requires further investigation via the Patchstack advisory.

The CVSS 3.1 base score of 5.3 (Medium) is consistent with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating a remotely exploitable, zero-complexity, unauthenticated flaw with limited integrity impact and no scope change. Real-world risk is bounded by the low integrity-only impact - an attacker can modify something, but cannot read sensitive data or crash the service per the available scoring. No EPSS score was provided in the input data, so exploitation probability cannot be quantified precisely. There is no CISA KEV listing and no reported public exploit code, placing this in the lower-urgency tier absent evidence of active targeting. The primary elevating factor is the complete absence of authentication prerequisites combined with low attack complexity, meaning any internet-facing WordPress site running this theme is theoretically reachable without any prior foothold. The Civi theme is niche rather than ubiquitous, limiting aggregate exposure. Overall this is a genuine vulnerability warranting patching on a normal patch cycle, but not an emergency requiring immediate out-of-band response.

An unauthenticated remote attacker sends a crafted HTTP POST request directly to the vulnerable WordPress AJAX or REST endpoint exposed by the Civi theme, requiring no session cookie or authentication token. Because no privilege check is enforced, the server executes the restricted action - such as modifying theme settings, content, or user-visible data - and returns a success response. No public exploit code has been identified at time of analysis, but the low complexity means a motivated attacker could develop a working proof-of-concept through routine WordPress endpoint enumeration.