What is the CVSS score of CVE-2026-66465?

CVE-2026-66465 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Cartify WordPress Theme are affected by CVE-2026-66465?

Cartify Multipurpose WooCommerce WordPress theme versions 1.3.0.1 and earlier contain a critical unauthenticated authentication bypass (CVE-2026-66465, CVSS 9.8) enabling any attacker to assume…

How to fix or mitigate CVE-2026-66465?

Within 24 hours: immediately deactivate the Cartify theme across all affected WordPress installations to block exploitation while assessing alternatives. Within 7 days: audit all user accounts and administrator login activity for unauthorized access since theme deployment, contact the theme vendor to confirm patch timeline, and identify replacement WooCommerce themes ready for migration. Within 30 days: deploy the patched Cartify version once released by the vendor, or complete migration to an alternative actively maintained theme; implement organizational policy requiring timely updates to all WordPress themes and plugins with quarterly review cycles.

Cartify WordPress Theme CVE-2026-66465

EUVD-2026-57884 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-13 Patchstack

GHSA-3gjh-xgvh-pw38

WordPress Information Disclosure Cartify Wordpress Theme

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated account takeover of an admin over the network with low complexity yields PR:N/AC:L/AV:N and full C/I/A impact, matching the reported 9.8.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:32 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

AnalysisAI

Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Cartify is a commercial multipurpose e-commerce theme for WordPress built to integrate with WooCommerce, so affected installs are typically online storefronts handling customer accounts, orders, and payment metadata. The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning the theme exposes an authentication or account-management routine - commonly a custom login, social-login, OTP, or password-reset handler shipped by the theme - that trusts an attacker-controllable value (such as a user ID, email, or token) instead of verifying a secret. The single CPE, cpe:2.3:a:agnihd:cartify:*:*:*:*:*:*:*:*, identifies vendor 'agnihd' and product 'cartify' with all versions up to and including 1.3.0.1 in scope.

RemediationAI

Update the Cartify theme to a fixed release newer than 1.3.0.1 as published by the vendor via the Patchstack advisory (https://patchstack.com/database/wordpress/theme/cartify-multipurpose-woocommerce-wordpress-theme/vulnerability/wordpress-cartify-theme-1-3-0-1-account-takeover-vulnerability); the input does not include an exact fixed version number, so verify the patched version directly on that advisory before deploying, and treat this as 'Patch available per vendor advisory' rather than a confirmed version. If an update cannot be applied immediately, deploy a WAF or virtual patch (Patchstack offers one for this vulnerability) to filter requests to the theme's authentication and account endpoints, restrict access to the affected login/registration/password-reset routes, and monitor for unexpected privilege escalations or new administrator accounts - noting that virtual patching does not remove the underlying flaw and endpoint restrictions may disrupt legitimate customer login flows. As a precaution, force a password reset and invalidate active sessions for privileged accounts after patching in case takeover already occurred.