EUVD-2026-96443
GHSA-2fpp-g3hj-qhqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running DK theme <= 3.2.1
-
ExploitSend crafted request to unprotected endpoint
-
ExecutionBypass missing authorization check
-
ImpactPerform unauthorized state-changing action (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only stated prerequisite is a WordPress installation running the ThemeGoods DK theme at version 3.2.1 or earlier, reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are indicated - exploitation targets the theme's access-control-deficient functionality as shipped. The practical limiting factor is product reach: only sites that have installed and activated this specific commercial theme are affected, which substantially narrows the exposed population despite the unauthenticated network vector. The exact feature or endpoint that lacks the authorization check is not specified in the available data. |
| Impact | Signals are mixed and point to a moderate, not emergency, priority. The CVSS 3.1 base score is 7.5 (HIGH) driven entirely by the AV:N/AC:L/PR:N/UI:N vector - a remote, low-complexity, unauthenticated flaw - but the impact is scoped narrowly to integrity only (C:N/I:H/A:N), consistent with CWE-862 (Missing Authorization) and the 'Broken Access Control' characterization. No EPSS score, SSVC decision data, KEV listing, or POC indicator was supplied in the input, so exploitation probability and automatability cannot be derived. Exploitation status: no public exploit identified at time of analysis. The vendor-independent risk is tempered by product footprint: DK is a single commercial WordPress theme from ThemeGoods, far narrower than a core plugin or platform. Note a mild tag/description tension - the record is tagged 'Authentication Bypass' while the description and CWE-862 describe missing authorization (broken access control); these are related but distinct weaknesses, and the CVSS impact (integrity-only, no confidentiality) suggests unauthorized state modification rather than full authentication bypass - verify the exact affected endpoint with Patchstack. Treat as a standard-priority patch for sites running the DK theme, not a drop-everything issue absent EPSS/KEV evidence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request directly to a DK theme endpoint that fails to verify authorization, performing a state-changing action normally restricted to privileged users. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be issued against any reachable WordPress site running DK <= 3.2.1. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated attackers can tamper with WordPress sites running the ThemeGoods DK theme at version 3.2.1 or earlier by abusing theme functionality that lacks an authorization check (CWE-862), rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning integrity-only impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this reads as a moderate rather than emergency priority; the dominant limiting factor is product reach, since only sites that installed and activated this specific commercial theme are affected. Neither the vulnerable endpoint nor a patched version is disclosed in the available data, which leaves defenders without a precise target for either exploitation or mitigation.
RemediationAI
No vendor-released patch has been identified at time of analysis, and no fixed version number appears in the available data, so the primary action is to deactivate and, ideally, remove the ThemeGoods DK theme and migrate the site to an actively maintained theme - the trade-off is that deactivation changes the site's layout and may break widgets, menus, customizer settings, and any shortcodes the theme provided, so this should be done during a maintenance window with a staging copy to rebuild the design. If the theme cannot be removed immediately, apply virtual patching at the edge: block unauthenticated POST requests to wp-admin/admin-ajax.php for actions belonging to the theme, deny anonymous access to any theme-registered REST routes, and add WAF rules for /wp-content/themes/dk/ PHP files that are not known static assets; the trade-off is that the affected endpoint has not been published, so these rules may be either too broad (breaking legitimate theme features) or too narrow (missing the vulnerable route), and they require ongoing tuning. Because exploitation gives an attacker write access with no read primitive, also review wp_options, posts, users metadata, and theme settings for unauthorized modifications and revert them, and consider rotating any secrets that could have been altered rather than read. Monitor the Patchstack advisory page at https://patchstack.com/database/wordpress/theme/dk/vulnerability/wordpress-dk-theme-3-2-1-broken-access-control-vulnerability?_s_id=cve and the ThemeGoods vendor channel for a patched release, and apply the fixed version as soon as it is named; until then treat the theme as unpatched and do not rely on configuration hardening alone to remove the exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862, Missing Authorization, in a third-party WordPress theme. Themes are ordinary PHP that runs inside the WordPress request lifecycle, so they commonly expose privileged operations through admin-ajax.php handlers registered with wp_ajax_nopriv_*, admin-post.php actions, REST API routes registered without a permission_callback, shortcodes, or directly reachable template/PHP files; when such a route performs a state-changing operation without a current_user_can() capability check or nonce verification, it becomes reachable by any anonymous visitor. The CPE cpe:2.3:a:themegoods:dk:*:*:*:*:*:*:*:* identifies the ThemeGoods 'DK' product with an unconstrained version wildcard, and the vendor advisory scopes the issue to all releases up to and including 3.2.1. The CVSS vector is internally consistent with an unauthenticated, network-reachable, low-complexity bug that requires no user interaction and no non-default configuration: PR:N confirms no credentials are needed, and AC:L indicates no race condition or special precondition. The impact profile is notable because the vector assigns I:H but C:N and A:N - the attacker can write or modify state (options, content, theme settings or similar data) without the flaw itself granting read access to data or the ability to take the site down. The specific feature, action name, or REST route missing the check is not specified in the available reporting, so the entire theme surface should be treated as untrusted until a fixed release is published.
Know when Dk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Missing authorization reachable remotely without credentials or interaction gives AV:N/AC:L/PR:N/UI:N; unauthorized state change yields I:H with no confidentiality or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
Executive ViewAI
Organizations using the ThemeGoods DK theme (version 3.2.1 or earlier) on their WordPress sites are exposed to an unauthenticated integrity-tampering vulnerability that could allow attackers to alter site content or inject malicious code. While no public exploit code has been identified, the lack of a vendor patch and the potential for reputational damage and loss of customer trust make this a moderate priority for affected businesses. Leadership should ensure that all instances of this commercial theme are identified and either removed or protected with interim controls until a fix is available.
No vendor-released patch identified at time of analysis. Interim mitigations include: deactivating and removing the ThemeGoods DK theme if not business-critical; implementing virtual patching via a Web Application Firewall (WAF) to block unauthorized modification requests to theme files; enabling file integrity monitoring to detect tampering; restricting file system permissions to limit write access; and conducting regular manual integrity checks. Monitor the vendor for a patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB