What is the CVSS score of EUVD-2026-39954?

EUVD-2026-39954 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Spexo Theme EUVD-2026-39954

| CVE-2026-12471 MEDIUM

Missing Authorization (CWE-862)

2026-06-27 Wordfence

GHSA-q2p3-v4q2-729h

WordPress Authentication Bypass Spexo Wordpress Theme

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-exploitable with low authentication (Subscriber account); integrity-only impact limited to unauthorized plugin activation; no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 07:51 vuln.today

CVE Published

Jun 27, 2026 - 06:50 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set of plugins.

AnalysisAI

Unauthorized plugin activation in the Spexo WordPress theme (all versions through 2.0.11) is possible due to a missing capability check on the theme's activate_plugin function, exposing sites to integrity compromise by low-privileged authenticated users. Attackers holding Subscriber-level accounts or higher can trigger plugin activation outside of WordPress's native authorization controls, bypassing the intended administrator-only restriction. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS data was provided.

Technical ContextAI

The flaw is classified as CWE-862 (Missing Authorization) and resides in the Spexo theme's inc/activation/class-welcome-notice.php file, specifically the activate_plugin function (visible at line 304 of version 2.0.11 in the WordPress theme repository). WordPress enforces plugin management through the activate_plugins capability, which is normally restricted to Administrator-level roles. The Spexo theme (CPE: cpe:2.3:a:templatescoderthemes:spexo:*:*:*:*:*:*:*:*) invokes plugin activation logic from a welcome/onboarding notice without performing this capability check, allowing any authenticated user - including Subscribers - to call the function. The scope of activation is constrained to a limited set of plugins bundled or suggested by the theme, not the full WordPress plugin ecosystem.

RemediationAI

Update the Spexo theme beyond version 2.0.11 once a patched release is published to the WordPress theme directory; a fix changeset has been committed to the theme repository (https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=334799%40spexo&new=334799%40spexo), but a specific released version number for the fixed build is not independently confirmed from available data - verify the current version in the WordPress theme directory before updating. As an immediate compensating control, administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent self-provisioning of Subscriber accounts, which eliminates the primary unauthenticated attack path; the trade-off is that this blocks legitimate community signups. Additionally, auditing currently active plugins and removing any that were unexpectedly activated can detect prior exploitation. A WordPress security plugin such as Wordfence or WP Activity Log can monitor for unauthorized plugin state changes.