What is the CVSS score of EUVD-2026-11893?

EUVD-2026-11893 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Envo Extra are affected by EUVD-2026-11893?

Organizations using Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra should be aware of moderate risk from CVE-2026-32386, a missing authorization vulnerability rated CVSS 5.4.

How to fix or mitigate EUVD-2026-11893?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Envo Extra EUVD-2026-11893

| CVE-2026-32386 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Envo Extra

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 10:22 NVD

5.4 (MEDIUM) 4.3 (MEDIUM)

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11893

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.13.

AnalysisAI

Envo Extra through version 1.9.13 contains an authorization bypass that allows authenticated attackers to access or modify sensitive data due to improperly configured access controls. An attacker with valid credentials can exploit this vulnerability to perform unauthorized actions within the plugin. No patch is currently available, and the vulnerability has not been confirmed as actively exploited.

Technical ContextAI

This vulnerability is classified as CWE-862 (Missing Authorization), a common web application security flaw where access control checks are either absent or improperly implemented. The Envo Extra plugin, which provides extended functionality for EnvoThemes WordPress themes (CPE: cpe:2.3:a:envothemes:envo-extra), fails to properly validate user permissions before allowing access to sensitive operations or data. The plugin runs within the WordPress ecosystem and likely lacks proper capability checks (such as current_user_can() in WordPress) when handling authenticated requests, allowing users with the 'subscriber' or 'contributor' role to perform actions restricted to 'editor' or 'administrator' roles. This represents a horizontal privilege escalation vulnerability where authenticated attackers can laterally access resources beyond their intended scope.

RemediationAI

Immediately upgrade EnvoThemes Envo Extra to a patched version beyond 1.9.13 (check the official EnvoThemes website or WordPress plugin repository for the latest stable release). If an immediate patch is not available from the vendor, temporarily disable the Envo Extra plugin until an update is released, and restrict WordPress user roles to only those necessary for your site operations—review and audit user permissions to ensure principle of least privilege is enforced. As an interim mitigation, limit login access to trusted IP addresses via Web Application Firewall rules or .htaccess restrictions, and monitor WordPress user activity logs for unauthorized access attempts to restricted features. Contact EnvoThemes support directly for notification of patch availability and recommended upgrade procedures.