Style Kits
Monthly
Broken access control in the Style Kits WordPress plugin (versions ≤ 2.6.5) allows subscriber-level authenticated users to perform privileged actions due to missing authorization checks (CWE-862). The integrity impact is rated High by the vendor CVSS, meaning a low-privilege WordPress account holder can manipulate site content or plugin settings beyond their intended role. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity and purely network-based vector make this straightforward to abuse on any affected site with open user registration.
Broken Access Control in the Style Kits WordPress plugin (versions <= 2.6.5) permits authenticated users holding Contributor-level roles to execute privileged actions without proper authorization checks, as classified under CWE-862 (Missing Authorization). Reported by Patchstack and tracked as EUVD-2026-48095, the flaw is remotely exploitable with low attack complexity and no user interaction, exposing partial confidentiality, integrity, and availability of affected WordPress installations. No public exploit code or active exploitation has been identified at time of analysis.
The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Broken access control in the Style Kits WordPress plugin (versions ≤ 2.6.5) allows subscriber-level authenticated users to perform privileged actions due to missing authorization checks (CWE-862). The integrity impact is rated High by the vendor CVSS, meaning a low-privilege WordPress account holder can manipulate site content or plugin settings beyond their intended role. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity and purely network-based vector make this straightforward to abuse on any affected site with open user registration.
Broken Access Control in the Style Kits WordPress plugin (versions <= 2.6.5) permits authenticated users holding Contributor-level roles to execute privileged actions without proper authorization checks, as classified under CWE-862 (Missing Authorization). Reported by Patchstack and tracked as EUVD-2026-48095, the flaw is remotely exploitable with low attack complexity and no user interaction, exposing partial confidentiality, integrity, and availability of affected WordPress installations. No public exploit code or active exploitation has been identified at time of analysis.
The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.