What is the CVSS score of EUVD-2026-41294?

EUVD-2026-41294 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Martfury Theme EUVD-2026-41294

| CVE-2026-57685 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-4whc-9fj9-8jg8

WordPress Authentication Bypass Martfury Woocommerce Marketplace Wordpress Theme Wordpress Theme

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Subscriber authentication confirmed by vulnerability title and PR:L; network vector and low integrity-only impact align with missing authorization on a theme endpoint.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:33 vuln.today

CVE Published

Jul 02, 2026 - 11:15 cve.org

MEDIUM 4.3

DescriptionCVE.org

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

AnalysisAI

Broken access control in Martfury WooCommerce Marketplace WordPress Theme (versions <= 3.2.8) permits authenticated subscriber-level users to invoke functionality restricted to higher-privilege roles, achieving unauthorized integrity modifications. The flaw is rooted in CWE-862 (Missing Authorization), where theme-controlled endpoints or action handlers fail to verify that the requesting user holds sufficient capabilities beyond basic authentication. No public exploit or CISA KEV listing was present in the available data at time of analysis.

Technical ContextAI

The affected product is the Martfury WooCommerce Marketplace WordPress Theme by drfuri (CPE: cpe:2.3:a:drfuri:martfury_-_woocommerce_marketplace_wordpress_theme:*:*:*:*:*:*:*:*), a commercial theme enabling multi-vendor marketplace functionality on top of WooCommerce. The root cause class is CWE-862 (Missing Authorization): WordPress themes that register AJAX handlers, REST API endpoints, or custom form actions must explicitly gate those routes with capability checks (e.g., current_user_can()) corresponding to the required privilege level. When those checks are absent, any authenticated user - including a subscriber, the lowest default WordPress role typically assigned to customers or registered marketplace buyers - can trigger privileged operations. The title 'Subscriber Broken Access Control' specifically identifies subscriber-role users as the minimal exploiting principal, consistent with the CVSS PR:L metric.

RemediationAI

Upgrade the Martfury WooCommerce Marketplace WordPress Theme beyond version 3.2.8 by consulting the Patchstack advisory (https://patchstack.com/database/wordpress/theme/martfury/vulnerability/wordpress-martfury-woocommerce-marketplace-wordpress-theme-theme-3-2-8-broken-access-control-vulnerability) for the exact patched release version - an explicit fix version was not confirmed in the available input data. As an interim compensating control, site administrators should disable public subscriber registration to reduce the exploitable user pool, accepting the trade-off of blocking new marketplace sign-ups. Additionally, restricting AJAX and REST endpoints at the web server or WAF layer to authenticated sessions with validated nonces can reduce attack surface, though this requires custom configuration. Theme AJAX handlers should be audited for missing current_user_can() or check_ajax_referer() calls if source access is available.