EUVD-2025-210757
GHSA-f42p-gfh3-368w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated network exploitation confirmed by description and tags; no confidentiality impact; limited integrity and availability impact consistent with broken access control scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
AnalysisAI
Broken access control in the Altair WordPress theme (ThemeGoods) through version 5.2.2 permits unauthenticated remote attackers to invoke restricted functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any internet-reachable WordPress installation running the affected theme is exposed. Impact is bounded to partial integrity and availability degradation (C:N/I:L/A:L); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
CWE-862 (Missing Authorization) describes a failure to verify that the requesting user holds the necessary privilege before performing a sensitive action. In WordPress themes, this typically manifests as AJAX action handlers, REST API routes, or admin-post endpoints registered without capability checks (e.g., missing current_user_can() guards), allowing any visitor - authenticated or not - to trigger those actions. The CPE string cpe:2.3:a:themegoods:altair:*:*:*:*:*:*:*:* identifies the ThemeGoods commercial theme 'Altair' as the affected component. The tag 'Authentication Bypass' corroborates that the missing check is at the authentication/authorization boundary, not merely a privilege escalation within an authenticated context.
RemediationAI
Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/altair/vulnerability/wordpress-altair-theme-5-2-2-broken-access-control-vulnerability for the confirmed fix version and upgrade immediately if one is available. If no patched release has been issued, as a compensating control consider temporarily switching the active WordPress theme to a supported alternative to eliminate the attack surface entirely - deactivating the theme removes all registered endpoints and handlers introduced by Altair. Alternatively, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php or REST API routes specific to Altair's functionality can reduce exploitation risk, though this may impact legitimate front-end features of the theme. No generic 'defense in depth' substitutes for upgrading to a patched version once available.
Altair PBS Professional through 19.1.2 allows Privilege Escalation because an attacker can send a message directly to pb
Deserialization of Untrusted Data vulnerability in ThemeGoods Altair allows Object Injection.2.2. Rated critical severit
Altair is a GraphQL Client. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack
Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerabilit
Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability d
Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability d
Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today