What is the CVSS score of CVE-2026-65487?

CVE-2026-65487 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Photography Theme CVE-2026-65487

EUVD-2026-48098 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-q7c8-h34g-m94m

WordPress Authentication Bypass Photography Wordpress Theme Themegoods

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable handler with no authentication required; impact confined to low-integrity writes, no confidentiality or availability effect, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:20 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

AnalysisAI

Broken access control in the Photography WordPress theme by ThemeGoods (versions ≤ 7.7.6) permits remote unauthenticated attackers to perform unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms trivial network exploitability with low complexity, rooted in CWE-862 (Missing Authorization), where theme logic fails to enforce capability checks before processing sensitive requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The Photography theme (CPE: cpe:2.3:a:themegoods:photography:*:*:*:*:*:*:*:*) is a premium WordPress theme developed by ThemeGoods. CWE-862 (Missing Authorization) indicates that one or more of the theme's server-side handlers - likely WordPress AJAX nopriv hooks (wp_ajax_nopriv_*), REST API endpoints, or theme-specific POST handlers - omit capability or nonce verification before executing privileged operations. In the WordPress ecosystem, this pattern typically manifests as theme options, form submissions, or media/gallery management endpoints that can be invoked by any visitor without authentication. The scope is limited to the vulnerable system (S:U), meaning exploitation does not pivot to other services, but any WordPress site actively running this theme version is exposed to unauthorized write operations.

RemediationAI

The primary remediation is to update the Photography theme to a version beyond 7.7.6 as soon as ThemeGoods releases a patched build; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/photography/vulnerability/wordpress-photography-theme-7-7-6-broken-access-control-vulnerability for the confirmed fix version, which has not been independently verified in the available data. If an update is not immediately available, install a WordPress WAF plugin (e.g., Patchstack, Wordfence) that applies virtual patching to block exploitation of this specific broken access control pattern - note that WAF rules add request-processing overhead and may conflict with legitimate theme functionality. Additionally, restrict wp-admin and AJAX endpoint access by IP at the web server or CDN level if the site's user base permits it; this mitigates the AV:N/PR:N risk vector but may break front-end theme features for remote legitimate users.