Grocery Shopping Store CVE-2026-93949

Exploitation requires the target WordPress site to have the Omegathemes 'Grocery Shopping Store' theme installed and active at version 1.3.3 or earlier, and specifically depends on the theme's password-recovery/reset functionality, which is the vulnerable alternate authentication channel (CWE-288). The CVSS vector's PR:L indicates some privilege is required rather than fully unauthenticated access, which limits exploitation; however, this conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified against the Patchstack advisory. No user interaction is needed (UI:N), and the attack is network-reachable (AV:N) against any affected installation; the principal practical limiter is the theme's narrow deployment footprint.

The input provides a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H (base 7.1, HIGH), indicating network-reachable, low-complexity exploitation that requires some level of privilege (PR:L) and no user interaction. No EPSS score, no CISA KEV listing, and no public exploit (POC) were supplied, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. The signals are therefore limited and somewhat internally inconsistent: CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and the phrase 'Password Recovery Exploitation' usually describe an account-takeover primitive that is reachable pre-authentication, yet the Patchstack vector sets PR:L (privileges required) and C:N (no confidentiality impact) while assigning A:H (high availability impact) - an unusual combination for a password-recovery flaw, where one would more typically expect integrity/confidentiality impact from hijacked accounts. This discrepancy should be verified against the Patchstack advisory. Overall this reads as a genuine but not high-urgency issue: a real authentication-bypass bug in a niche WordPress theme with no evidence of in-the-wild exploitation or available exploit code, so it is a patch-when-practical item rather than an emergency, and its real-world blast radius is constrained by the theme's small deployment footprint.

A remote attacker targets a WordPress site running the Grocery Shopping Store theme (<= 1.3.3) and abuses a flaw in the password-recovery flow to bypass authentication via an alternate path, gaining access to a user account. Per the CVSS vector the attacker needs some minimal privilege level (PR:L) and no user interaction. No public exploit code was identified at the time of analysis.