What is the CVSS score of CVE-2026-65500?

CVE-2026-65500 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Manual WordPress Theme are affected by CVE-2026-65500?

The pixelacehq Manual WordPress theme (v7.5.4 and earlier) contains an authorization bypass permitting unauthenticated remote attackers to access sensitive data without credentials.

How to fix or mitigate CVE-2026-65500?

Within 24 hours, scan all WordPress installations to identify those running pixelacehq Manual theme versions 7.5.4 and earlier. Within 7 days, immediately deactivate or remove the affected theme, implement firewall rules restricting WordPress administrative access to VPN or trusted networks only, and apply Web Application Firewall rules to block unauthenticated requests to sensitive endpoints. Within 30 days, migrate to an alternative maintained WordPress theme, audit system logs for evidence of unauthorized access dating back to theme installation, and evaluate data exposure scope for regulatory notification requirements.

Manual WordPress Theme CVE-2026-65500

EUVD-2026-48111 HIGH

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-fjmq-7549-p52c

WordPress Authentication Bypass Manual Documentation Knowledge Base Education Wordpress Theme Wordpress Theme Pixelacehq

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable missing-authorization read on a default install (AV:N/AC:L/PR:N/UI:N); impact limited to information disclosure, so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:30 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

AnalysisAI

Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote unauthenticated attackers reach functionality or data that should be access-restricted, due to a missing authorization check (CWE-862). Rated CVSS 7.5 with a confidentiality-only impact, the flaw was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a commercial WordPress theme (cpe:2.3:a:pixelacehq:manual_-_documentation,_knowledge_base_&_education_wordpress_theme) marketed for documentation, knowledge-base and education sites. The root cause is CWE-862 (Missing Authorization): a code path - typically an AJAX action, REST endpoint, or theme handler registered by the theme - executes without verifying the caller's capability or nonce/authorization state. In WordPress themes this class of bug commonly arises when handlers hooked via wp_ajax_nopriv_* or unauthenticated init/template routes omit current_user_can() or permission callbacks, allowing anonymous requests to invoke privileged read operations. The CVSS confidentiality-only profile (C:H/I:N/A:N) indicates the exposed operation reads/returns protected data rather than modifying state.

RemediationAI

Update the Manual theme to the first release above 7.5.4 as published by the vendor pixelacehq; the input data does not include an exact fixed version, so no vendor-released patch version is independently confirmed - verify the fixed build via the Patchstack advisory (https://patchstack.com/database/wordpress/theme/manual/vulnerability/wordpress-manual-documentation-knowledge-base-education-wordpress-theme-theme-7-5-4-broken-access-control-vulnerability) before deploying. If an updated theme is not yet available, apply compensating controls: place a WAF or virtual patch (Patchstack provides one) in front of the site, and restrict access to the vulnerable theme endpoint at the web-server level by blocking or authenticating the specific AJAX/REST route the theme exposes - the trade-off is that blocking the wrong route can break legitimate documentation/search functionality, so identify the exact handler from the advisory first. Where feasible, temporarily switch to a maintained theme if the exposed data is sensitive.