EUVD-2026-65300
GHSA-24r8-w5p9-r798
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint Jawn theme on target site
-
DeliverySend crafted unauthenticated request to role-assignment function
-
ExploitElevate controlled account to administrator
-
ExecutionInstall malicious plugin or webshell
-
ImpactFull site takeover and data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The only stated prerequisite is that the target WordPress site runs the Jawn theme at version 1.4.2 or earlier and that the vulnerable functionality is network-reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions - remote unauthenticated exploitation is possible against affected installations without authentication or user interaction. The primary limiting factor is deployment: exploitation requires the specific Jawn theme to be installed and active, which sharply narrows the target population; the description does not indicate any non-default configuration is needed to trigger the escalation. |
| Impact | All decision signals point toward high priority on paper: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact, yielding a 9.8 base score. However, the real-world risk is tempered by two factors that must be weighed together. First, no EPSS score, SSVC decision, POC flag, or KEV entry was provided in the input, so exploitation probability and automatability are unknown rather than confirmed low - absence of these signals is not evidence of low risk. Second, the affected product is a niche commercial theme with a limited deployment footprint, so even a trivially exploitable flaw is likely to see targeted rather than internet-wide mass exploitation. Net: treat as a genuine high-severity issue for any site actually running Jawn, but the aggregate internet-wide risk is bounded by low prevalence. Key missing data: no fixed version, no EPSS, no KEV/POC status. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running the Jawn theme (fingerprintable via theme assets in the page source) and sends a crafted unauthenticated request to the theme's vulnerable role-assignment functionality, granting an attacker-controlled or newly registered account administrator privileges. With admin access the attacker installs a malicious plugin or webshell to achieve full site and server-adjacent control. No public exploit code is identified at time of analysis, though the low attack complexity makes weaponization straightforward if the vulnerable code path is reverse-engineered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
No vendor-released patched version is identified in the available data - the advisory range covers all releases through 1.4.2 without naming a fixed build, so administrators should consult the Wordfence and Patchstack advisories (linked above) for an updated release and upgrade to any version published after 1.4.2 once confirmed by the vendor. Until a fixed version is verified, the most effective compensating control is to deactivate and remove the Jawn theme and switch to a maintained theme, which eliminates exposure but changes the site's appearance and may require re-theming. If removal is not feasible, place the site behind a WordPress WAF (such as Wordfence) with a virtual patch for this CVE, and restrict/monitor administrator account creation and role changes; note that virtual patching depends on rule coverage and does not remove the underlying vulnerable code. Do not rely on generic hardening alone given the unauthenticated nature of the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a commercial WordPress theme, Jawn, published by the vendor MvpThemes (CPE cpe:2.3:a:mvpthemes:jawn:*). WordPress themes frequently register AJAX handlers, REST endpoints, or user-management routines; a privilege-escalation flaw here typically stems from a theme function that assigns or modifies user roles/capabilities without properly verifying the caller's identity or authorization. The classification CWE-266 (Incorrect Privilege Assignment) indicates the root cause is that the theme grants a privilege level it should not - i.e., it lets a request set or elevate a user's role to administrator absent an authorization check, rather than a memory-safety or injection issue.
Know when Jawn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated remote privilege escalation to administrator, so AV:N/AC:L/PR:N/UI:N; admin takeover yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
Articles & Coverage 1
Executive ViewAI
The Jawn WordPress theme (versions ≤1.4.2) contains a critical unauthenticated privilege escalation vulnerability (CVE-2026-78477, CVSS 9.8) enabling any remote attacker to gain full administrator access to affected WordPress sites. Organizations using this theme face immediate risk of complete website compromise, data exfiltration, and operational takeover. With no vendor patch currently available, urgent remediation is required.
Until vendor patch is released: (1) Immediately deactivate and remove the Jawn theme; (2) Restrict WordPress login and administrative endpoints to allowlisted IP ranges; (3) Deploy Web Application Firewall rules to detect and block privilege escalation attempts; (4) Enable comprehensive audit logging on user account creation and administrator role assignments; (5) Implement intrusion detection signatures targeting this CVE's exploitation vectors; (6) Conduct forensic analysis of affected systems for evidence of unauthorized access or backdoors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attac
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the throw
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attack
Exploit-DB