Koji WordPress Theme CVE-2026-74020

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, no elevated privileges, no user interaction, and no special network position are required. The theme must be installed and active on a WordPress site. Exploitation is only meaningful when the affected site relies on Koji's theme-level access control logic to restrict access to sensitive content or functionality - sites where no content is gated through the theme's authorization mechanism would not expose sensitive data even if the flaw is triggered. The specific vulnerable endpoint (REST route, AJAX action, or template path) is not disclosed in the available data, so an attacker would need to enumerate or review theme code to identify the unprotected path. No particular server configuration, plugin combination, or WordPress version constraint is noted as a prerequisite.

The CVSS score of 7.5 is technically justified by the fully unauthenticated network vector (AV:N/AC:L/PR:N/UI:N) and high confidentiality impact; these metrics are internally consistent with a missing authorization check on a data-returning endpoint. However, several signals moderate real-world priority: no KEV listing, no public exploit code identified at time of analysis, and a limited deployment footprint (a niche independent-developer WordPress theme rather than a widely-deployed platform component). EPSS probability data was not provided in the input, so probabilistic exploitation likelihood cannot be assessed quantitatively. The non-changed scope (S:U) and absence of integrity or availability impact mean successful exploitation yields data disclosure, not system compromise. The principal risk is for WordPress site operators who use Koji as their active theme and rely on its access control logic to protect member-only or private content - those deployments face meaningful confidentiality exposure even without a known public exploit, given that the attack complexity is low once an attacker identifies the vulnerable endpoint.

An unauthenticated attacker identifies a WordPress site running Koji version 2.2.1 or earlier, then sends a direct HTTP request to a restricted endpoint - such as a protected page URL, REST route, or AJAX handler - without supplying authentication credentials. The theme's missing authorization check fails to validate the request, and the server returns the protected content. No public proof-of-concept has been identified at time of analysis, but low attack complexity means exploitation is achievable with standard HTTP tooling once the specific unprotected endpoint is enumerated.