EUVD-2026-11883Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-accessible vulnerability requiring no special complexity or privileges and no user interaction, placing it in the exploitable category. The integrity impact is limited (I:L) with no confidentiality or availability impact, suggesting the vulnerability enables unauthorized data modification rather than data exfiltration or system disruption. The moderate CVSS score of 5.3 reflects this focused impact scope. Without access to EPSS scores, KEV/CISA inclusion status, or public proof-of-concept code, the real-world risk appears moderate but non-critical; however, the lack of authentication requirement and network accessibility make this practically exploitable by any attacker with knowledge of the vulnerable endpoint. The attack surface depends on WordPress site exposure and theme popularity, making this a priority for WordPress administrators running Numinous but lower urgency for non-WordPress environments. |
| Exploit ScenarioDerived | An attacker discovers a WordPress site using Numinous theme version 1.3.0 and identifies an unprotected administrative function in the theme's code, such as a settings save handler or custom post modification endpoint. Without authentication, the attacker crafts a direct HTTP request (POST or GET) to trigger this function, potentially modifying site settings, injecting malicious content, or altering theme configuration. Because the vulnerability requires no user interaction, no special complexity, and no authentication, the attacker can automate this across multiple WordPress installations, making it suitable for mass exploitation campaigns targeting less-maintained WordPress sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
Numinous theme versions up to 1.3.0 contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify data through improperly configured access controls. The vulnerability affects the theme's security implementation and could enable unauthorized changes to application data without authentication. No patch is currently available for this issue.
Earlier versions of this analysis (1)
A missing authorization vulnerability exists in raratheme Numinous theme versions through 1.3.0, allowing unauthenticated attackers to exploit improperly configured access control mechanisms to perform unauthorized modifications. The vulnerability affects the Numinous WordPress theme and enables attackers to bypass access controls without requiring authentication, resulting in potential integrity compromise. While the CVSS score of 5.3 indicates moderate severity, the network-accessible nature and lack of privilege requirements make this a practical concern for WordPress installations using this theme.
RemediationAI
Upgrade the Numinous theme to a patched version greater than 1.3.0 as soon as a fix is released by raratheme. Check the official raratheme website or WordPress.org theme repository for version 1.3.1 or later. Until a patch is available, implement server-level access controls by restricting theme functionality endpoints using a Web Application Firewall (WAF) to block requests to suspicious theme action hooks, or temporarily disable the Numinous theme and switch to an alternative WordPress theme. Additionally, monitor WordPress logs for unauthorized POST requests to admin-ajax.php or REST API endpoints associated with the theme, and consider implementing a WordPress security plugin (such as Wordfence or Sucuri) to add integrity monitoring and access control hardening. For production environments with critical data, isolate the affected WordPress installation behind additional authentication layers or disable public access until patching is completed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as CWE-862 (Missing Authorization), which represents a fundamental access control failure where security mechanisms fail to properly verify user permissions before allowing sensitive operations. The affected product is the Numinous theme by raratheme, a WordPress theme that likely implements custom post types, settings pages, or REST API endpoints without adequate capability checks. The vulnerability suggests that functions handling content modification or configuration changes are missing WordPress nonce verification or role-based capability checks (wp_verify_nonce(), current_user_can()), allowing any network-based actor to trigger administrative actions. The issue spans from an unspecified initial version through Numinous 1.3.0, indicating the flaw existed through at least the 1.3.0 release cycle.
Know when Numinous gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Missing Authorization vulnerability in raratheme Numinous numinous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Numinous: from n/a through <= 1.3.0.
Executive ViewAI
Organizations using Missing Authorization vulnerability in raratheme Numinous numinous should be aware of moderate risk from CVE-2026-32380, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB