What is the CVSS score of EUVD-2026-20311?

EUVD-2026-20311 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Cream Blog EUVD-2026-20311

| CVE-2026-39648 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-j9hx-3gqc-82f3

Authentication Bypass Cream Blog

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20311

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.

AnalysisAI

Missing authorization in themebeez Cream Blog WordPress theme versions up to 2.1.7 allows unauthenticated remote attackers to bypass access controls and read sensitive information due to incorrectly configured access control security levels. With a CVSS score of 5.3 and EPSS exploitation probability of 0.02% (4th percentile), this represents a low real-world exploitation risk despite the network-accessible attack vector. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from a Missing Authorization flaw (CWE-862), which occurs when the application fails to properly enforce access control checks on sensitive resources or operations. In the context of the Cream Blog WordPress theme, this manifests as incorrectly configured access control security levels that allow attackers to bypass intended authorization mechanisms. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L) indicates the application is accessible over the network without authentication (PR:N), requires low attack complexity, and results in low confidentiality impact-meaning an attacker can access data they should not have permission to view, but cannot modify system integrity or cause denial of service. The CPE identifier cpe:2.3:a:themebeez:cream_blog:*:*:*:*:*:*:*:* confirms this is a WordPress theme product rather than a plugin or core software, affecting all versions through 2.1.7.

RemediationAI

The primary remediation is to update Cream Blog to a patched version above 2.1.7; interested users should consult the themebeez vendor advisory at https://patchstack.com/database/Wordpress/Theme/cream-blog/vulnerability/wordpress-cream-blog-theme-2-1-7-broken-access-control-vulnerability?_s_id=cve for the exact fixed version and upgrade instructions. In the interim, WordPress administrators should review and restrict access to sensitive theme functionality through WordPress user role and capability management, ensuring that custom access controls are properly enforced via WordPress hooks or by disabling affected features until patching is possible. Additional hardening may include implementing Web Application Firewalls (WAF) rules to monitor and block unauthorized access attempts to affected endpoints.