VW Writer Blog EUVD-2026-83539

Requires an authenticated account with Subscriber-level access or above on a WordPress site running the VW Writer Blog theme version 1.3.8 or earlier; the 'vw_writer_blog_reset_all_settings' function lacks a capability check (current_user_can) so any such account can invoke it. Limiting factors: valid low-privilege authentication is mandatory (not exploitable unauthenticated), impact is confined to resetting theme customizer settings (integrity only - no data disclosure, code execution, or downtime), and sites where user registration is disabled and no low-privilege accounts exist face materially reduced exposure.

This is a genuine but low-severity issue, best characterized as high-noise-low-priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 MEDIUM) is internally consistent with the description: a network-reachable, low-complexity flaw requiring low privileges (any authenticated Subscriber) with impact limited to integrity (I:L) - resetting theme customizer settings - and no confidentiality or availability impact. No EPSS score, no CISA KEV listing, and no public PoC were provided, so this is 'no public exploit identified at time of analysis.' Real-world risk is constrained by two factors: the attacker must already hold a valid account (PR:L), and the impact is purely a nuisance-grade defacement/misconfiguration reset rather than data theft or code execution. The 'Authentication Bypass' tag is misleading - CWE-862 (Missing Authorization) and the PR:L vector confirm this is a broken-access-control/authorization flaw for already-authenticated low-privilege users, NOT an authentication bypass. Priority should be routine patching, not emergency response.

An attacker registers or obtains a Subscriber-level account on a WordPress site running the VW Writer Blog theme (or leverages an existing low-privilege account). They send an authenticated request invoking the unprotected 'vw_writer_blog_reset_all_settings' function, wiping all theme customizer configuration back to defaults and disrupting the site's appearance and branding. No public exploit code is identified, but the attack is trivial given the missing capability check and low attack complexity.