What is the CVSS score of EUVD-2026-51940?

EUVD-2026-51940 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Lenxel WP are affected by EUVD-2026-51940?

The Lenxel WP WordPress theme (all versions through 1.0.31) contains a critical flaw in its password reset mechanism that permits unauthenticated attackers to seize control of any WordPress account,…

Is there a public PoC exploit available for EUVD-2026-51940?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51940. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-51940?

Within 24 hours, audit all WordPress installations to identify sites using Lenxel WP theme versions through 1.0.31 and prioritize those hosting sensitive data or administrative functions. Within 7 days, implement interim controls by deactivating the Lenxel WP theme, reverting to an alternative maintained WordPress theme, and requiring all affected account holders to reset passwords from a known-safe system; enable WordPress two-factor authentication plugin for administrative accounts as additional layering. Within 30 days, establish a policy to audit third-party WordPress theme usage for security advisories and implement version management to prevent use of unmaintained theme versions in production environments.

Lenxel WP EUVD-2026-51940

| CVE-2026-12586 HIGH

Improper Authentication (CWE-287)

2026-08-02 WPScan

GHSA-rhj3-v77h-x35q

WordPress Authentication Bypass CSRF Lenxel Wp Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Nonce freely obtainable by any visitor; username enumeration standard on WordPress, justifying AC:L over NVD's AC:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 19:26 vuln.today

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

AnalysisAI

Account takeover via unauthenticated password reset in the Lenxel WP WordPress theme (all versions through 1.0.31) allows any unauthenticated remote attacker to seize control of any WordPress account, including site administrators, by submitting a crafted reset request without owning or being authorized for the target account. The theme's reset action validates only a WordPress CSRF nonce - obtainable by any visitor loading the reset page - while performing no ownership or authorization check against the account being reset. No confirmed active exploitation (not in CISA KEV), though a public POC exists via WPScan and SSVC rates the technical impact as total; EPSS remains very low at 0.12% (2nd percentile), consistent with the niche theme footprint.

Technical ContextAI

The Lenxel WP theme (CPE: cpe:2.3:a:unknown:lenxel_wp:*:*:*:*:*:*:*:*, versions ≤1.0.31) implements a custom password-reset handler that conflates anti-CSRF protection with authorization. WordPress nonces are action-scoped, time-limited replay-prevention tokens - they establish that a form was generated by WordPress, not that the submitter owns the targeted account. CWE-287 (Improper Authentication) captures the root cause precisely: the system accepts a credential-change request without verifying the identity or entitlement of the requester. Because the nonce is embedded in a publicly accessible form page, any unauthenticated visitor can retrieve a valid token and immediately weaponize it to reset an arbitrary account's password. No server-side binding between the nonce and the target user account is enforced.

RemediationAI

No vendor-released patch identified at time of analysis. Site operators running Lenxel WP through version 1.0.31 should immediately deactivate or remove the theme and substitute an actively maintained alternative - this is the only remediation that fully eliminates exposure. As a compensating control, blocking requests to the theme's specific password-reset AJAX action or REST route via a WAF rule (e.g., ModSecurity or a CDN-layer rule targeting the action parameter) can prevent exploitation but will also break the theme's legitimate password-reset flow for all users. Independently enforcing two-factor authentication on all administrator and editor accounts substantially limits the damage of a successful password reset by requiring a second factor the attacker does not possess. Disabling WordPress username enumeration (blocking /wp-json/wp/v2/users and suppressing login error specificity) raises attacker effort marginally but is not a reliable standalone control. Monitor the WPScan advisory (https://wpscan.com/vulnerability/84555dc3-b35e-478f-b681-ea0a0fe481d9/) and VulDB entry (https://vuldb.com/vuln/385327) for patch availability.