EUVD-2026-43395Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running VW Wedding theme
-
DeliveryLocate unprotected theme AJAX or REST endpoint
-
ExploitSend unauthenticated HTTP request with crafted parameters
-
ExecutionBypass missing authorization check
-
ImpactTrigger restricted operation causing availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to have the VW Wedding theme by vowelweb installed and active in version 1.3.7 or earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication is required and no user interaction is needed, meaning exploitation is possible against any internet-accessible installation without credentials. The limiting factors are: (1) the narrow availability-only impact (A:L) restricts attacker utility, (2) the specific theme must be active - not merely installed - on the target site, and (3) no public exploit or detailed technical writeup is available, raising the bar for exploitation. Sites where the VW Wedding theme is inactive or absent are not affected. |
| Impact | The CVSS 3.1 score of 5.3 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) vector, but the impact metrics are constrained: no confidentiality loss (C:N), no integrity impact (I:N), and only low availability impact (A:L). This impact profile is notable - for a broken access control flaw tagged as 'Authentication Bypass,' the absence of integrity impact in the CVSS vector is unusual and may indicate the exploitable action is limited to triggering resource consumption or a denial-of-service-class behavior rather than data exfiltration or content modification. EPSS data is not provided; no KEV listing and no public POC exist, making real-world exploitation probability low at time of analysis. Overall, this represents a genuine but low-priority vulnerability: network reachable and unauthenticated, but with a narrow, low-severity impact. Defenders should prioritize patching but need not treat this as an emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running VW Wedding theme version 1.3.7 or earlier - discoverable via HTTP response headers or source inspection - and sends a crafted HTTP request to a theme-registered endpoint that lacks authorization checks. The missing authorization gate allows the request to succeed without credentials, triggering a restricted operation that results in limited availability degradation of the WordPress instance. No public POC has been identified, so exploitation currently requires independent discovery of the vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Broken access control in the VW Wedding WordPress theme (vowelweb) allows unauthenticated remote attackers to exploit incorrectly configured authorization checks, resulting in limited availability impact against affected WordPress installations. All versions through 1.3.7 are affected per the CPE string cpe:2.3:a:vowelweb:vw_wedding. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, placing this in the lower-urgency tier despite network-level reachability.
RemediationAI
No specific fixed version is identified in the available data; no exact patch version can be cited from the provided references. Site administrators should check the WordPress theme repository or vowelweb's distribution channel for a version newer than 1.3.7 and upgrade immediately if available. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/vw-wedding/vulnerability/wordpress-vw-wedding-theme-1-3-7-broken-access-control-vulnerability should be monitored for patch confirmation. As a compensating control, administrators can temporarily restrict access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) and REST API routes introduced by this theme using a web application firewall (WAF) rule, though this may break theme functionality. Alternatively, deactivating the theme and switching to a maintained alternative eliminates exposure entirely. If the theme cannot be replaced, enabling a WordPress security plugin (e.g., Patchstack, Wordfence) with virtual patching for this CVE provides a temporary mitigation layer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
VW Wedding is a WordPress theme developed by vowelweb, covering wedding-related site presentation functionality. The root cause is CWE-862 (Missing Authorization), meaning the theme fails to perform adequate capability or permission checks before executing certain operations. In WordPress, this class of flaw typically arises when AJAX handlers, REST API endpoints, or admin-ajax actions registered by a theme do not validate whether the calling user holds the necessary role or nonce. The CPE cpe:2.3:a:vowelweb:vw_wedding:*:*:*:*:*:*:*:* confirms the vulnerability spans all tracked versions up to and including 1.3.7. The tag 'Authentication Bypass' from Patchstack suggests at least one code path skips authorization gates entirely, consistent with CWE-862.
Know when Vw Wedding gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable WordPress endpoint with no auth required; impact limited to availability per description and CWE-862 scope, no confidentiality or integrity evidence.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB