What is the CVSS score of EUVD-2026-48125?

EUVD-2026-48125 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Avada Custom Branding EUVD-2026-48125

| CVE-2026-65524 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-3qfj-62g7-5w9p

WordPress Authentication Bypass Wordpress Plugin Avada Custom Branding Themefusion

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via HTTP (AV:N), contributor authentication required (PR:L), no complexity barriers (AC:L), read-only limited disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:12 vuln.today

DescriptionCVE.org

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

AnalysisAI

Broken Access Control in the Avada Custom Branding WordPress plugin (versions <= 1.2) allows authenticated users with contributor-level roles to access functionality or data restricted to higher-privileged roles, resulting in unauthorized information disclosure. The CVSS vector confirms network-exploitable, low-privilege exploitation with a limited confidentiality impact (C:L) and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk constrained despite the medium CVSS score.

Technical ContextAI

Avada Custom Branding (CPE: cpe:2.3:a:themefusion:avada_custom_branding:*:*:*:*:*:*:*:*) is a WordPress plugin developed by ThemeFusion - the vendor behind the Avada theme - designed to enable white-label branding of the WordPress admin interface. CWE-862 (Missing Authorization) identifies the root cause class: the plugin fails to enforce proper capability checks on one or more actions or REST endpoints accessible to contributor-role users, allowing them to trigger or read resources intended only for administrators or editors. This is a common weakness in WordPress plugins where capability checks (e.g., current_user_can()) are absent or insufficiently granular for lower-privileged roles.

RemediationAI

Update the Avada Custom Branding plugin to a version beyond 1.2 once a patched release is issued by ThemeFusion. The exact fixed version is not confirmed in currently available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fusion-white-label-branding/vulnerability/wordpress-avada-custom-branding-plugin-1-2-broken-access-control-vulnerability and the WordPress plugin repository for release notes. As a compensating control, site administrators should audit contributor-role accounts and remove any untrusted or unnecessary contributor users until a patch is confirmed. Restricting the WordPress contributor role via a role-management plugin to reduce its permitted capabilities may also limit exploitability, though this introduces the trade-off of potentially breaking intended editorial workflows.