CVE-2026-23974
Published: 22 January 2026
Summary
CVE-2026-23974 is a medium-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-24 (Access Control Decisions).
Deeper analysis
CVE-2026-23974 is a missing authorization vulnerability, classified under CWE-862, in the uxper Golo golo WordPress theme. It enables exploitation of incorrectly configured access control security levels. The issue affects Golo versions from n/a through those prior to 1.7.5. The vulnerability carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating medium severity with low integrity impact.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows limited integrity violations, such as unauthorized modifications to resources due to broken access controls.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/golo/vulnerability/wordpress-golo-theme-1-7-5-broken-access-control-vulnerability?_s_id=cve details the broken access control issue in the Golo WordPress theme, specifically referencing version 1.7.5 in the context of the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3830
Vulnerability details
Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress theme directly enables remote exploitation of the web application with no authentication required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access to the Golo theme resources, blocking the unauthenticated modifications enabled by the missing authorization flaw.
Limits privileges assigned to unauthenticated or low-privilege sessions so that even a bypassed access check cannot perform the unauthorized integrity changes described in the CVE.
Requires the system to adjudicate access decisions against explicit rules before allowing actions on Golo theme objects, addressing the incorrectly configured access control levels.