What is the CVSS score of CVE-2026-65476?

CVE-2026-65476 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Civi WordPress Theme CVE-2026-65476

EUVD-2026-48087 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-6xf3-hr92-36vc

WordPress Authentication Bypass Civi Wordpress Theme Uxper

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no credentials or interaction needed; integrity-only impact from unauthorized action execution; no scope change or confidentiality/availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:23 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

AnalysisAI

Broken access control in the Civi WordPress theme (by uxper) versions up to and including 2.2.4 permits unauthenticated remote attackers to perform restricted actions that should require authorization. The vulnerability stems from missing authorization checks (CWE-862), allowing network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to abuse against any unpatched installation.

Technical ContextAI

The affected product is the Civi WordPress theme developed by uxper, identified by CPE cpe:2.3:a:uxper:civi:*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) indicates that one or more WordPress REST API endpoints, AJAX handlers, or theme-specific callbacks fail to verify whether the requesting user holds the necessary capability or role before executing a privileged operation. In WordPress, this class of flaw typically arises when theme or plugin code registers actions (wp_ajax_nopriv_ hooks or REST routes without permission_callback) without enforcing capability checks such as current_user_can(), exposing state-modifying functionality to unauthenticated HTTP clients. The CVSS integrity impact (I:L) with no confidentiality or availability impact suggests the exposed action allows limited data or state modification rather than full system compromise.

RemediationAI

Update the Civi WordPress theme to a version above 2.2.4 as soon as a patched release is available from uxper via the WordPress theme repository or the vendor's distribution channel. No specific fixed version number is independently confirmed from the available input data - the Patchstack advisory at https://patchstack.com/database/wordpress/theme/civi/vulnerability/wordpress-civi-theme-2-2-4-broken-access-control-vulnerability should be consulted for the confirmed remediated version. If an immediate update is not possible, compensating controls include restricting access to WordPress AJAX endpoints (admin-ajax.php) and any theme-registered REST routes to authenticated sessions only via WAF rules, though this may break legitimate front-end functionality and requires testing. Disabling the theme and switching to an unaffected alternative is the most definitive interim measure if update availability is delayed. Monitoring WordPress access logs for unexpected POST requests to admin-ajax.php or /wp-json/ routes originating from unauthenticated sessions can provide detection coverage.