What is the CVSS score of CVE-2026-6801?

CVE-2026-6801 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Context Blog CVE-2026-6801

EUVD-2026-43153 MEDIUM

Information Exposure (CWE-200)

2026-07-11 Wordfence

GHSA-mpm3-jfch-qphv

WordPress Information Disclosure Context Blog Wordpress Theme

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no auth or interaction needed; only password-protected post text exposed (C:L); no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 06:55 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it possible for unauthenticated attackers to extract the content of password-protected posts.

AnalysisAI

Context Blog WordPress theme (all versions through 1.3.5) exposes the full content of password-protected posts to unauthenticated remote attackers through the context_blog_modal_popup component, effectively bypassing WordPress's native content-gating mechanism. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially low exploitation complexity with no authentication or user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded entirely by what site owners store behind password-protected posts.

Technical ContextAI

The affected product is the Context Blog WordPress theme by postmagthemes (CPE: cpe:2.3:a:postmagthemes:context_blog:*:*:*:*:*:*:*:*). The context_blog_modal_popup function - likely a front-end AJAX handler or template rendering component - fails to enforce WordPress's built-in post-password check before returning post content. WordPress's native password protection relies on a cookie-based verification (post_password) that theme and plugin code must explicitly honor; the modal popup endpoint omits this check entirely. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the theme renders restricted content to any requester without gating on the visitor's authenticated password-entry state.

RemediationAI

Update the Context Blog theme to the latest version available in the WordPress theme repository, which should incorporate the fix committed in Trac changeset 329636 (https://themes.trac.wordpress.org/changeset?reponame=&old=329636%40context-blog&new=329636%40context-blog). The exact fixed release version is not independently confirmed beyond the upstream commit reference - verify the installed version changelog before assuming the update resolves the issue. As a compensating control where immediate update is not feasible, administrators should avoid storing genuinely sensitive information in WordPress password-protected posts on sites running this theme, eliminating exploitable data without requiring a patch. A WAF rule blocking unauthenticated requests to the context_blog_modal_popup AJAX endpoint can serve as a temporary mitigation, though this may break legitimate modal functionality that the theme relies on for user experience. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/30f5eecd-3135-45a1-97d2-05fcbbca9e5f?source=cve for updated patch status.