EUVD-2025-210756
GHSA-wq94-w84x-hxwv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site using Capella <=2.5.5
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitTrigger improper privilege assignment (CWE-266)
-
ExecutionEscalate to administrator account
-
PersistInstall plugin or web shell
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The affected asset must be a WordPress installation running the ThemeGoods Capella theme at version 2.5.5 or earlier; that theme being active/installed is the concrete prerequisite. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions beyond network reachability are required - remote unauthenticated exploitation is possible with no authentication and no user interaction. The primary limiting factor is deployment: the vulnerability only affects sites specifically using the Capella theme, which is a niche commercial product, so the exploitable population is small even though each vulnerable site requires no additional configuration to be at risk. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) indicates network-reachable, low-complexity, unauthenticated exploitation with full impact - signals that normally correlate with high real-world risk. However, this severity is not corroborated by other exploitation signals in the provided data: no EPSS score was supplied, no KEV/active-exploitation status is present, and no POC is referenced, so widespread automated exploitation is not confirmed. SSVC decision inputs (automatable, exploitation state) were not provided. The realistic risk therefore hinges on deployment footprint: the theme is niche, so exploitation is likely opportunistic rather than mass-scale. Treat the high CVSS as a reason to patch promptly, while noting the absence of independent exploitation evidence. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable Capella-powered WordPress site, invoking a theme function that lacks proper capability or nonce enforcement and thereby granting the attacker elevated privileges (for example creating or promoting an account to administrator). With administrative control, the attacker installs a malicious plugin or web shell to fully take over the site. No public POC is identified at time of analysis, but the low attack complexity (AC:L) and lack of required interaction make weaponization straightforward for an attacker who reverse-engineers the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Privilege escalation in the ThemeGoods Capella WordPress theme (versions up to and including 2.5.5) allows unauthenticated remote attackers to gain elevated privileges within a WordPress site, per a CVSS 3.1 base score of 9.8. Because the flaw requires no authentication and no user interaction, an attacker can leverage it directly over the network to compromise site integrity, confidentiality, and availability. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS and unauthenticated nature make it a high-priority patching target.
RemediationAI
No vendor-released patch version is identified at time of analysis; the input confirms only that versions <= 2.5.5 are affected, so administrators should check ThemeGoods/Patchstack for a fixed release (a version above 2.5.5) and upgrade to it as the primary fix once available. Consult the Patchstack advisory for the authoritative fix status: https://patchstack.com/database/wordpress/theme/capella/vulnerability/wordpress-capella-theme-2-5-5-privilege-escalation-vulnerability?_s_id=cve. As compensating controls until a patched version is confirmed, deploy a WordPress WAF or Patchstack vApp virtual patch to block the exploit request pattern; restrict access to wp-admin and the site's AJAX/REST endpoints (admin-ajax.php, /wp-json/) by IP allowlist where feasible, accepting that this can break legitimate front-end AJAX features; and audit user accounts and roles for unexpected privilege grants, removing any unrecognized administrator accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capella is a commercial WordPress theme distributed by ThemeGoods, identified by the CPE cpe:2.3:a:themegoods:capella. The weakness is classified as CWE-266 (Incorrect Privilege Assignment), meaning the theme grants a privilege level or capability to an actor who should not receive it. In WordPress themes, this class of flaw typically stems from AJAX handlers, REST endpoints, or theme-option/import routines that fail to enforce capability checks (current_user_can) or nonce validation, allowing a request to perform privileged actions or elevate an account. The specific vulnerable code path was not disclosed in the available data beyond the privilege-escalation classification.
Know when Capella gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated (PR:N) network-reachable privilege escalation with no user interaction and low complexity yields full C/I/A impact, matching the reported 9.8 vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.
Executive ViewAI
A critical privilege escalation in the ThemeGoods Capella WordPress theme (versions up to 2.5.5) allows unauthenticated attackers to gain administrative control over affected WordPress sites without authentication or user interaction. Although no public exploit has been identified at time of analysis, the critical severity rating combined with the absence of a vendor patch creates immediate organizational risk. Any organization running this theme faces potential unauthorized access, data compromise, and site takeover.
No vendor-released patch identified at time of analysis. Interim mitigations include: immediately disable and replace the vulnerable theme with a maintained alternative; restrict WordPress administrative access via network controls or WAF; implement enhanced logging of all administrative actions and file system changes; disable automatic theme updates pending vendor patch; and consider temporary offline status for mission-critical systems. These controls reduce but do not eliminate risk-permanent remediation requires either vendor patch deployment or permanent theme replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB