EUVD-2026-63320
GHSA-wh6c-f85q-gq2p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no authentication or user interaction; confidentiality-only impact consistent with unauthorized data read rather than write or destructive operation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
AnalysisAI
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, no elevated privileges, no user interaction, and no special network position are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 7.5 is technically justified by the fully unauthenticated network vector (AV:N/AC:L/PR:N/UI:N) and high confidentiality impact; these metrics are internally consistent with a missing authorization check on a data-returning endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Koji version 2.2.1 or earlier, then sends a direct HTTP request to a restricted endpoint - such as a protected page URL, REST route, or AJAX handler - without supplying authentication credentials. The theme's missing authorization check fails to validate the request, and the server returns the protected content. … |
| Remediation | The primary remediation is to update the Koji theme to a version beyond 2.2.1 once the theme developer (Anders Norén) releases a patched build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations to identify those running Koji theme versions 2.2.1 and earlier and document the types of restricted content exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesyst
Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can
Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submis
Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation. Rated medium severity (CVSS
Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM. Rated medium severit
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today