Cyber Posture

CVE-2026-27051

Critical

Published: 25 March 2026

Published
25 March 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 18.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27051 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Enforces the principle of least privilege to directly counter privilege escalation from incorrect privilege assignment in the Golo theme.

prevent

Requires proper management and assignment of privileges to accounts, addressing the root cause of incorrect privilege assignment (CWE-266).

preventrecover

Mandates timely identification, reporting, and remediation of software flaws like this privilege escalation vulnerability in Golo versions <=1.7.0.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Unauthenticated remote privilege escalation in public-facing WordPress theme directly enables T1190 (Exploit Public-Facing Application) for initial access and T1068 (Exploitation for Privilege Escalation) to obtain high privileges.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0.

Deeper analysisAI

CVE-2026-27051 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the uxper Golo WordPress theme, which allows for privilege escalation. The issue affects Golo versions from n/a through 1.7.0 and was published on 2026-03-25.

With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation enables privilege escalation, potentially granting high-impact access to confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/golo/vulnerability/wordpress-golo-theme-1-7-0-privilege-escalation-vulnerability?_s_id=cve provides details on this privilege escalation vulnerability in the WordPress Golo theme version 1.7.0. Security practitioners should review it for recommended mitigations.

Details

CWE(s)

CVEs Like This One

CVE-2026-32520Shared CWE-266
CVE-2025-44655Shared CWE-266
CVE-2026-23800Shared CWE-266
CVE-2026-32519Shared CWE-266
CVE-2026-32488Shared CWE-266
CVE-2026-32916Shared CWE-266
CVE-2025-68869Shared CWE-266
CVE-2024-56000Shared CWE-266
CVE-2026-23550Shared CWE-266
CVE-2026-24968Shared CWE-266

References