EUVD-2026-94950
GHSA-gggp-wf55-7xrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WordPress user
-
ExploitSend request to unprotected plugin action
-
ExecutionBypass missing authorization check
-
ImpactRead unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privilege account on a WordPress installation running the VillaTheme Core plugin at version 1.0.5 or earlier (PR:L); unauthenticated access is not sufficient. The flaw is a missing authorization check on a plugin feature, so the site must have the plugin installed and active and must allow the relevant account tier to register or exist. No user interaction by a victim is needed (UI:N), and no special non-default configuration is identified in the available data, but the specific affected function/endpoint is not disclosed, so the exact feature that must be reachable cannot be named from the input. |
| Impact | This is a moderate, low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the CWE-862 Missing Authorization classification: a remote, low-complexity flaw requiring low privileges (PR:L - an authenticated account) with only limited confidentiality impact and no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation or weaponization - this appears to be a routine Patchstack-reported broken-access-control finding rather than an urgent threat. The PR:L requirement meaningfully limits risk: an attacker needs at least a low-privilege authenticated session (commonly subscriber/customer-level on WordPress). The 'Authentication Bypass' tag is somewhat misleading given CVSS PR:L indicates authentication is required, not bypassed; the more accurate framing is missing authorization (privilege/access-control check absent), consistent with CWE-862. No conflicting signals between vector and description were found, though the description is sparse and provides no specific affected endpoint or function. |
| Exploit ScenarioDerived | A low-privileged authenticated user (e.g., a subscriber or customer account on a WordPress site running VillaTheme Core ≤1.0.5) sends a request to a plugin function that fails to verify the caller's authorization level, allowing the user to read data they should not be able to access. No public proof-of-concept is identified, and exploitation yields only limited confidentiality disclosure with no data modification. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Missing authorization checks in the VillaTheme Core WordPress plugin, affecting versions up to and including 1.0.5, allow an authenticated low-privilege user to reach plugin functionality that should require higher capabilities, resulting in limited information disclosure. The flaw carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and per the assessed vector is not exploitable by unauthenticated users - an account on the WordPress site is a prerequisite (PR:L). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; impact is limited to low confidentiality exposure with no integrity or availability effect, making this a moderate, low-priority issue.
RemediationAI
No vendor-released fixed version is identified in the available data - the Patchstack advisory referenced above is the authoritative source to monitor for a patched release, and the affected range extends through 1.0.5, so upgrading should be performed only to a version the vendor explicitly confirms is fixed. Until then, prioritize compensating controls: if VillaTheme Core is not required for the active theme/plugins, deactivate and remove it (trade-off: dependent VillaTheme components may lose functionality); otherwise tighten the account surface, since exploitation requires an authenticated low-privilege user - disable open/self-registration, audit and prune subscriber and other low-privilege accounts, and review role capabilities so only trusted users hold accounts (trade-off: legitimate community or customer registrations are blocked). A WAF or reverse-proxy rule that restricts access to the plugin's admin-ajax.php actions, REST routes, and admin-post.php endpoints to trusted roles or IP ranges reduces exposure but may break legitimate front-end features. Because the impact is confined to low-confidentiality disclosure with no integrity or availability effect, remediation can be scheduled as routine maintenance rather than emergency patching, and no evidence of public exploit code or active exploitation was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing authorization weakness (CWE-862) in VillaTheme Core, a companion/support plugin used by VillaTheme WordPress themes and plugins. Root cause is an absent or insufficient capability/permission check on a plugin-exposed function or endpoint, so a request from a low-privileged authenticated WordPress user is processed as though it came from a higher-privileged role. In the WordPress ecosystem this class typically manifests in AJAX handlers (admin-ajax.php actions), REST API routes, or admin-post.php callbacks that fail to call current_user_can() or check a nonce before returning data. The affected component is the plugin at version 1.0.5 or earlier on any WordPress installation where it is installed and active (EUVD records the affected range as 'VillaTheme Core 0 ≤ 1.0.5'). According to the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the attack is network-reachable, requires no user interaction, does not change scope, and yields only low-confidentiality impact. The advisories do not disclose the specific function or endpoint involved, so the exact reachable feature cannot be named from the available data.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Missing authorization reachable over the network with low complexity but requiring a low-privilege authenticated account (PR:L); only limited confidentiality disclosure, no integrity or availability impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB