Cyber Resilience

CVE-2025-26733

High

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS Score 0.0022 45.3th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26733 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-26733 is a missing authorization vulnerability, classified under CWE-862, in the Traveler WordPress theme developed by shinetheme. The issue affects all versions of the Traveler theme from n/a through those prior to 3.2.1. Published on 2025-03-27, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L), highlighting its high severity due to network accessibility and lack of prerequisites.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high integrity impact, allowing unauthorized modifications to application data, alongside low availability impact, potentially disrupting service partially.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-broken-access-control-vulnerability?_s_id=cve details the broken access control issue in the Traveler theme, with mitigation achieved by updating to version 3.2.1 or later, as versions through < 3.2.1 remain vulnerable.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

The CVE describes a remote unauthenticated vulnerability in a public-facing WordPress theme, directly enabling exploitation via T1190. The high integrity impact from unauthorized modifications to application data directly facilitates T1565.001 Stored Data Manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-0952Shared CWE-862
CVE-2025-24591Shared CWE-862
CVE-2026-27386Shared CWE-862
CVE-2026-34053Shared CWE-862
CVE-2026-3360Shared CWE-862
CVE-2026-4277Shared CWE-862
CVE-2025-1657Shared CWE-862
CVE-2026-27071Shared CWE-862
CVE-2026-25131Shared CWE-862
CVE-2026-4283Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for logical access to information and system resources, directly preventing unauthorized modifications exploited by the missing authorization vulnerability in the Traveler theme.

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and correction of flaws such as this missing authorization issue, achieved by updating the vulnerable Traveler theme to version 3.2.1 or later.

AC-6 Least Privilege partial match
prevent

Employs least privilege to restrict access to only what is necessary, mitigating the impact of unauthorized data modifications allowed by the broken access control.

References