What is the CVSS score of EUVD-2025-210641?

EUVD-2025-210641 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Accelerate Theme EUVD-2025-210641

| CVE-2025-9266 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 Wordfence

GHSA-rxwq-9x24-g2q4

WordPress Authentication Bypass Accelerate

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Requires Subscriber-level authentication (PR:L) over network (AV:N); impact is integrity-only from unauthorized plugin installation (I:L), no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 12:26 vuln.today

CVE Published

Aug 06, 2026 - 11:29 nvd

MEDIUM 4.3

DescriptionCVE.org

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin.

AnalysisAI

Unauthorized plugin installation in the ThemeGrill Accelerate WordPress theme (versions up to and including 1.5.3) is possible because the enqueue_scripts() function performs no WordPress capability check before triggering ThemeGrill Demo Importer plugin installation. Any user holding at least a Subscriber-level account on the affected site can exploit this to install and activate an additional plugin, expanding the attack surface. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) describes the root cause: the enqueue_scripts() hook handler in class-accelerate-admin.php does not call current_user_can() or an equivalent WordPress capability gate before executing privileged plugin-installation logic. WordPress's role-based access control depends entirely on theme and plugin code explicitly verifying user capabilities at every privileged action boundary; omitting this check means any authenticated session - including the lowest default role of Subscriber - can reach the install/activate code path. The affected product is identified by CPE cpe:2.3:a:themegrill:accelerate:*:*:*:*:*:*:*:* covering all versions through 1.5.3. The fix is visible in the WordPress theme trac changeset for version 1.5.4, which patches class-accelerate-admin.php to introduce the missing capability check.

RemediationAI

Update the Accelerate theme to version 1.5.4 or later, which patches the missing capability check in class-accelerate-admin.php as documented in the WordPress theme trac changeset (https://themes.trac.wordpress.org/changeset/283564). If immediate update is not possible, disable open user registration under Settings > General in WordPress to eliminate the pool of unauthenticated-to-Subscriber escalation paths - note this may impact community or membership site functionality. Alternatively, site administrators can temporarily switch to a different active theme to neutralize the vulnerable code path until patching is feasible, with the trade-off of visual/functional disruption to the site.