Manual WordPress Theme CVE-2026-65500

Exploitation requires only that the target WordPress site have the pixelacehq Manual theme (version <= 7.5.4) installed and active, exposing the vulnerable access-control-deficient endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special client configuration are needed against a default install. The primary limiting factor is deployment prevalence - the site must actually run this specific commercial theme - and the impact ceiling is confidentiality only (C:H/I:N/A:N), so the attacker gains unauthorized read access to protected data but cannot directly modify content or disrupt availability through this flaw.

Signals are moderately consistent but data is thin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivially reachable, network-based, unauthenticated exploitation with no user interaction, which normally warrants prompt patching; however impact is bounded to confidentiality (C:H, I:N, A:N), so this is a data-exposure issue rather than site takeover or RCE. No EPSS score, KEV listing, or POC was provided, so exploitation likelihood cannot be quantified from the input - the absence of a POC and KEV entry suggests no confirmed active exploitation, but Patchstack-catalogued WordPress theme access-control bugs are frequently trivial to reproduce once details are public. Real priority is elevated for any site actually running this theme because the barrier to exploitation is low, but overall fleet risk is tempered by the theme's limited deployment footprint. Note a gap: the exact nature of the disclosed data is not specified in the description - confirm scope with the Patchstack advisory.

An attacker enumerates WordPress sites running the Manual theme and sends a crafted unauthenticated HTTP request directly to the theme's unprotected endpoint. Because the handler performs no authorization check, the server returns restricted information to the anonymous caller, requiring no credentials, no user interaction, and only low attack complexity. No public POC is identified at time of analysis, but the low-complexity network vector makes reproduction straightforward once the vulnerable route is known.