Kalon EUVD-2026-11878

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates this is a network-based vulnerability with low attack complexity, requiring no privileges or user interaction, making exploitation trivial. While the integrity impact is rated as low and there is no confidentiality or availability impact, the combination of a completely unauthenticated attack surface (PR:N), network accessibility (AV:N), and low complexity (AC:L) suggests this could be actively exploited at scale. The lack of authentication requirements is a critical control failure that could enable account takeover, unauthorized content modification, or privilege escalation depending on what operations the vulnerable endpoints perform. This represents a moderate-to-high real-world priority despite the low CVSS score, as unauthorized modification in a theme component could compromise website integrity and user trust.

An unauthenticated attacker on the internet could send specially crafted HTTP requests directly to vulnerable Kalon endpoints that lack proper authorization checks, potentially modifying theme settings, content, or configuration without needing valid credentials or user interaction. For example, if a Kalon API endpoint accepts POST requests to update theme options without verifying the user's role or authentication status, an attacker could automate requests to alter the site appearance, inject malicious content, or redirect users to phishing pages. The low attack complexity and absence of any client-side prerequisites make this trivial to exploit at scale across multiple affected WordPress installations.