CVE-2025-26733
Published: 27 March 2025
Summary
CVE-2025-26733 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to information and system resources, directly preventing unauthorized modifications exploited by the missing authorization vulnerability in the Traveler theme.
Requires identification, reporting, and correction of flaws such as this missing authorization issue, achieved by updating the vulnerable Traveler theme to version 3.2.1 or later.
Employs least privilege to restrict access to only what is necessary, mitigating the impact of unauthorized data modifications allowed by the broken access control.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated vulnerability in a public-facing WordPress theme, directly enabling exploitation via T1190. The high integrity impact from unauthorized modifications to application data directly facilitates T1565.001 Stored Data Manipulation.
NVD Description
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
Deeper analysisAI
CVE-2025-26733 is a missing authorization vulnerability, classified under CWE-862, in the Traveler WordPress theme developed by shinetheme. The issue affects all versions of the Traveler theme from n/a through those prior to 3.2.1. Published on 2025-03-27, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L), highlighting its high severity due to network accessibility and lack of prerequisites.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high integrity impact, allowing unauthorized modifications to application data, alongside low availability impact, potentially disrupting service partially.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-broken-access-control-vulnerability?_s_id=cve details the broken access control issue in the Traveler theme, with mitigation achieved by updating to version 3.2.1 or later, as versions through < 3.2.1 remain vulnerable.
Details
- CWE(s)