CVE-2026-27051
Published: 25 March 2026
Summary
CVE-2026-27051 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces the principle of least privilege to directly counter privilege escalation from incorrect privilege assignment in the Golo theme.
Requires proper management and assignment of privileges to accounts, addressing the root cause of incorrect privilege assignment (CWE-266).
Mandates timely identification, reporting, and remediation of software flaws like this privilege escalation vulnerability in Golo versions <=1.7.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote privilege escalation in public-facing WordPress theme directly enables T1190 (Exploit Public-Facing Application) for initial access and T1068 (Exploitation for Privilege Escalation) to obtain high privileges.
NVD Description
Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0.
Deeper analysisAI
CVE-2026-27051 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the uxper Golo WordPress theme, which allows for privilege escalation. The issue affects Golo versions from n/a through 1.7.0 and was published on 2026-03-25.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation enables privilege escalation, potentially granting high-impact access to confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/golo/vulnerability/wordpress-golo-theme-1-7-0-privilege-escalation-vulnerability?_s_id=cve provides details on this privilege escalation vulnerability in the WordPress Golo theme version 1.7.0. Security practitioners should review it for recommended mitigations.
Details
- CWE(s)