EUVD-2026-63328
GHSA-qmwx-j4xp-5vx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Chaplin theme
-
ExploitSend unauthenticated HTTP request to restricted endpoint
-
ExecutionTheme omits authorization check
-
ImpactRestricted content disclosed to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the Chaplin theme being installed, activated, and on a version <= 2.6.8 on any internet- or network-accessible WordPress instance. Per CVSS PR:N, exploitation is unauthenticated - no account or session on the target site is needed. Per AV:N/AC:L, the attack is network-reachable with low complexity. The primary limiting factor is that the Chaplin theme must be the active theme or have its code present and loaded; deactivated themes do not expose vulnerable code paths. No specific non-default configuration is required to trigger the vulnerability. |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-severity, trivially exploitable information-disclosure path: no authentication, no user interaction, and low attack complexity. The C:H rating indicates that whatever content is exposed is considered fully compromised in terms of confidentiality. However, real-world priority should be tempered by the narrow deployment footprint of the Chaplin theme - it is a niche theme by an individual developer, not a broadly deployed enterprise product. No EPSS data was provided; no KEV listing is present; no POC is cited in the available references. SSVC signals suggest exploitation is theoretically automatable (AV:N/AC:L/PR:N) and the technical impact is total on confidentiality, but the affected population is small. For organizations running this theme, this is a genuine remediation priority. For broad triage, prevalence limits aggregate risk. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running the Chaplin theme by inspecting theme-identifying HTTP headers, HTML comments, or CSS paths. The attacker then sends a crafted unauthenticated HTTP request to the unguarded endpoint or template registered by the theme, bypassing the missing authorization check, and receives restricted content such as draft posts, private pages, or user-accessible data. No public exploit code has been identified at time of analysis, but the low complexity of this class of flaw means exploitation requires no specialized tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
RemediationAI
The primary remediation is to update the Chaplin theme to a version beyond 2.6.8 - the exact patched release version is not independently confirmed from the available data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/chaplin/vulnerability/wordpress-chaplin-theme-2-6-8-broken-access-control-vulnerability and the WordPress theme repository for the current release. If an update is not immediately available or feasible, a compensating control is to deactivate the Chaplin theme and switch to an alternative until a patched version is released - this eliminates the attack surface entirely, though it changes site appearance. Alternatively, use a WordPress Web Application Firewall (e.g., Patchstack, Wordfence) configured to virtually patch broken access control patterns on this theme's routes; note that WAF coverage depends on the specific endpoint and rule quality. Do not rely on obscurity - unauthenticated network access means the vulnerable endpoint can be discovered through automated scanning.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chaplin is a WordPress theme developed by Anders Norén, identified via CPE cpe:2.3:a:anders_norén:chaplin:*:*:*:*:*:*:*:*. WordPress themes can register REST API routes, AJAX handlers, or page templates that access restricted data; CWE-862 (Missing Authorization) indicates that one or more of these entry points in Chaplin lacks a capability or nonce check before serving content. In WordPress, proper authorization is typically enforced via current_user_can() checks or rest_permission_callback definitions. The absence of such checks - the root cause here - allows any network-reachable party to invoke the unguarded functionality and retrieve data that should be access-controlled.
Know when Chaplin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, no authentication per description and tags; confidentiality-only impact with no integrity or availability effect confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
Executive ViewAI
The Chaplin WordPress theme (versions ≤2.6.8) contains a broken access control vulnerability enabling unauthenticated remote access to protected content, creating direct exposure of restricted data on any affected WordPress installation. Organizations using this theme face confidentiality risk from competitors, threat actors, or insiders accessing sensitive business or customer information without detection.
No vendor-released patch identified at time of analysis. Interim mitigations: Deploy WAF rules restricting unauthenticated access to protected resource paths; enforce WordPress role-based access control and capability restrictions; disable affected theme and migrate to alternative until patch availability confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB