Cyber Resilience

CVE-2026-22383

High

Published: 20 February 2026

Published
20 February 2026
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0006 19.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22383 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-22383 is an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) in the PawFriends - Pet Shop and Veterinary WordPress Theme from Mikado-Themes. The flaw stems from exploiting incorrectly configured access control security levels and affects all versions of the theme from n/a through 1.3 inclusive. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.

An unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation enables bypassing authorization controls via a user-controlled key, potentially leading to high-impact denial of service without affecting confidentiality or integrity.

The Patchstack advisory provides further details on this insecure direct object reference (IDOR) vulnerability in the PawFriends theme version 1.3, including mitigation guidance: https://patchstack.com/database/Wordpress/Theme/pawfriends/vulnerability/wordpress-pawfriends-pet-shop-and-veterinary-wordpress-theme-theme-1-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.

CWE(s)
CWE-639

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Direct unauthenticated remote exploitation of public-facing WordPress app via IDOR/authz bypass to achieve application-layer DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-50693Shared CWE-639
CVE-2025-69394Shared CWE-639
CVE-2026-41471Shared CWE-639
CVE-2025-58402Shared CWE-639
CVE-2025-68051Shared CWE-639
CVE-2026-4503Shared CWE-639
CVE-2026-43890Shared CWE-639
CVE-2026-25563Shared CWE-639
CVE-2024-8261Shared CWE-639
CVE-2026-3321Shared CWE-639

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Requires enforcement of approved authorizations for access to system resources, directly preventing the authorization bypass via user-controlled key in this IDOR vulnerability.

SI-2 Flaw Remediation good match
preventrecover

Mandates timely identification, reporting, and correction of flaws like this authorization bypass in the PawFriends theme, enabling patching to eliminate the vulnerability.

SC-5 Denial-of-service Protection partial match
prevent

Implements safeguards to protect against denial-of-service attacks, mitigating the high availability impact resulting from exploitation of the authorization bypass.

References