What is the CVSS score of EUVD-2026-26747?

EUVD-2026-26747 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Ona WordPress Theme EUVD-2026-26747

| CVE-2026-6812 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-02 Wordfence

SSRF WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 06:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 06:00 euvd

EUVD-2026-26747

Analysis Generated

May 02, 2026 - 06:00 vuln.today

CVE Published

May 02, 2026 - 05:29 nvd

MEDIUM 4.4

DescriptionCVE.org

The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AnalysisAI

Server-Side Request Forgery in the Ona WordPress theme versions up to 1.26 via the ona_activate_child_theme function allows authenticated administrators to make arbitrary web requests originating from the affected server, enabling query and modification of internal services. The vulnerability requires administrator-level privileges and high attack complexity, limiting real-world exploitation to compromised or malicious admin accounts. No public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability exists in the ona_activate_child_theme administrative function within the Ona theme's theme-admin.php file (lines 688-694). It is a CWE-918 Server-Side Request Forgery (SSRF) flaw, meaning the application accepts user-controlled input to construct HTTP requests without proper validation or sanitization. An administrator can supply a malicious URL parameter that causes the theme to issue web requests to internal services, local network resources, or external targets. This is particularly dangerous in WordPress environments where internal services (databases, cache servers, configuration endpoints) may be accessible only from localhost or internal networks. The Ona theme is distributed via the WordPress.org plugin repository (cpe:2.3:a:deothemes:ona), suggesting it has significant adoption among WordPress sites.

RemediationAI

Update the Ona theme to a version later than 1.26 as soon as a patched version is released by deothemes. At the time of this analysis, no patched version has been independently confirmed; monitor the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0acb365c-b5f2-4377-875b-69278a8ff96e?source=cve for patch availability. As an interim compensating control, strictly limit WordPress administrator role assignment to trusted users only and implement role-based access controls (RBAC) to ensure only essential staff retain admin privileges. Additionally, monitor and log all calls to the ona_activate_child_theme function and restrict outbound HTTP/HTTPS requests from the web application to a whitelist of necessary external endpoints using firewall rules or WAF policies. Disable the Ona theme's child theme activation feature if it is not actively used, via modifying theme-admin.php or disabling the associated admin menu options. These controls reduce the attack surface but do not eliminate the vulnerability; a proper patched release is required for full remediation.