EUVD-2026-65300
GHSA-24r8-w5p9-r798
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated remote privilege escalation to administrator, so AV:N/AC:L/PR:N/UI:N; admin takeover yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only stated prerequisite is that the target WordPress site runs the Jawn theme at version 1.4.2 or earlier and that the vulnerable functionality is network-reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All decision signals point toward high priority on paper: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact, yielding a 9.8 base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running the Jawn theme (fingerprintable via theme assets in the page source) and sends a crafted unauthenticated request to the theme's vulnerable role-assignment functionality, granting an attacker-controlled or newly registered account administrator privileges. With admin access the attacker installs a malicious plugin or webshell to achieve full site and server-adjacent control. … |
| Remediation | No vendor-released patched version is identified in the available data - the advisory range covers all releases through 1.4.2 without naming a fixed build, so administrators should consult the Wordfence and Patchstack advisories (linked above) for an updated release and upgrade to any version published after 1.4.2 once confirmed by the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using the Jawn theme and immediately disable or remove it to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today