EUVD-2026-63328
GHSA-qmwx-j4xp-5vx8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, no authentication per description and tags; confidentiality-only impact with no integrity or availability effect confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
AnalysisAI
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the Chaplin theme being installed, activated, and on a version <= 2.6.8 on any internet- or network-accessible WordPress instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-severity, trivially exploitable information-disclosure path: no authentication, no user interaction, and low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Chaplin theme to a version beyond 2.6.8 - the exact patched release version is not independently confirmed from the available data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/chaplin/vulnerability/wordpress-chaplin-theme-2-6-8-broken-access-control-vulnerability and the WordPress theme repository for the current release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress installations running Chaplin theme version 2.6.8 or earlier; segregate or restrict network access to affected sites if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today