EUVD-2026-48098
GHSA-q7c8-h34g-m94m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable handler with no authentication required; impact confined to low-integrity writes, no confidentiality or availability effect, no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
AnalysisAI
Broken access control in the Photography WordPress theme by ThemeGoods (versions ≤ 7.7.6) permits remote unauthenticated attackers to perform unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms trivial network exploitability with low complexity, rooted in CWE-862 (Missing Authorization), where theme logic fails to enforce capability checks before processing sensitive requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation is possible against any WordPress installation running Photography theme version 7.7.6 or earlier, per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium rating is consistent with the impact profile: integrity is only marginally affected (I:L), with no confidentiality (C:N) or availability (A:N) impact, capping the practical damage an attacker can achieve in a single exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker visits a WordPress site running Photography theme ≤ 7.7.6 and sends a crafted HTTP POST or GET request directly to the theme's unprotected AJAX or REST handler, omitting the capability check that should gate the action. Because no authentication, nonce, or role verification is enforced (CWE-862), the server processes the request and performs the unauthorized modification - such as altering theme settings, gallery entries, or other writable content. … |
| Remediation | The primary remediation is to update the Photography theme to a version beyond 7.7.6 as soon as ThemeGoods releases a patched build; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/photography/vulnerability/wordpress-photography-theme-7-7-6-broken-access-control-vulnerability for the confirmed fix version, which has not been independently verified in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Photography
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today