EUVD-2026-64808
GHSA-mww2-cm7j-fqfv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Jawn theme
-
DeliverySend crafted request to theme handler
-
ExploitBypass missing capability check
-
ExecutionObtain administrator privileges
-
PersistInstall webshell or malicious plugin
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The target site must have the Jawn theme (mvpthemes) installed and active at version 1.4.2 or earlier and be reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required, so exploitation works against a default install of the affected theme. The primary limiting factor is deployment scope - only sites actually running this specific niche theme are exposed; the precise vulnerable feature/endpoint is not detailed in the available data. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes the worst-case profile: network-reachable, low-complexity, unauthenticated, no user interaction, with full impact - consistent with unauthenticated privilege escalation to admin. However, several corroborating signals are absent: there is no EPSS score, no KEV listing, and no SSVC decision data in the input, and no public exploit has been identified at time of analysis, so real-world exploitation pressure cannot be confirmed from the data provided. The single Patchstack reference is a database entry rather than a detailed technical writeup, so the exact exploitation primitive is not independently verifiable here. Given WordPress's automated, opportunistic attack ecosystem, a confirmed 9.8 unauthenticated privesc in an installed theme should be treated as urgent by any operator running it even though the deployment footprint of this specific theme is niche; the mismatch to watch is high CVSS severity versus currently thin exploitation evidence, which argues for prompt patching but not necessarily for assuming mass exploitation is already underway. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to a theme-provided endpoint on a public WordPress site running Jawn ≤ 1.4.2 and, because the handler mis-assigns privileges, gains administrator-level capability without any login. With that access they can install a malicious plugin or webshell and take full control of the site. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS profile rather than a published PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified at time of analysis - the input lists affected versions up to 1.4.2 but does not name a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/jawn/vulnerability/wordpress-jawn-theme-1-4-2-privilege-escalation-vulnerability) and the mvpthemes vendor page for an update newer than 1.4.2 and upgrade as soon as one is published. Until a fixed version is confirmed, effective compensating controls include deploying a WordPress WAF or virtual patch (Patchstack offers one for this entry) to block the vulnerable request path, restricting or monitoring new administrator/role creation, and - if the theme is not essential - switching to a maintained theme, accepting the trade-off of losing Jawn-specific layout and features. Auditing existing user accounts for unexpected privilege grants is advisable given the privilege-escalation nature.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a commercial WordPress theme (CPE cpe:2.3:a:mvpthemes:jawn), meaning the vulnerable code executes inside the WordPress PHP runtime with access to the site's roles-and-capabilities system. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), a class where an application grants a user more capabilities than intended - in WordPress themes this typically stems from a theme-supplied AJAX action, registration/profile handler, or option-update routine that fails to enforce a proper capability check (current_user_can) or nonce verification, letting a caller set or assume a higher role. Because themes run with full WordPress privileges, a logic gap here can translate directly into administrative capability assignment.
Know when Jawn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network privilege escalation to admin with no user interaction warrants AV:N/AC:L/PR:N/UI:N, and administrative takeover yields full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
Executive ViewAI
The Jawn WordPress theme (versions ≤1.4.2) contains a critical privilege escalation vulnerability (CVSS 9.8) that allows unauthenticated remote attackers to gain administrator control of affected WordPress sites. Any organization using this theme faces immediate risk of complete site compromise, including data exfiltration, malware injection, and service disruption. Immediate remediation is required to protect WordPress infrastructure from exploitation.
Since no vendor-released patch is identified at time of analysis, interim mitigations include: immediately disable the Jawn theme to prevent exploitation; implement role-based access controls limiting who can be assigned administrator privileges; deploy WordPress-specific Web Application Firewall (WAF) rules to detect and block exploitation patterns targeting privilege escalation; enable multi-factor authentication (MFA) on all remaining WordPress administrator accounts; establish real-time alerts on administrator login attempts and role privilege changes; and maintain enhanced logging with offsite retention to detect post-compromise activity if exploitation occurs before theme removal is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthen
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the throw
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attack
Exploit-DB