Cyber Posture

CVE-2026-27386

High

Published: 05 March 2026

Published
05 March 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0004 12.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27386 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-862

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

addresses: CWE-862

Reviews of access controls detect missing authorization checks on critical functions or resources.

addresses: CWE-862

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

addresses: CWE-862

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

addresses: CWE-862

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

addresses: CWE-862

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

addresses: CWE-862

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

addresses: CWE-862

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
Why these techniques?

Broken access control (CWE-862) in a public-facing WordPress plugin is directly exploitable remotely without authentication (T1190); successful exploitation enables high-integrity unauthorized modifications to stored data (T1565.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.

Deeper analysisAI

CVE-2026-27386 is a missing authorization vulnerability (CWE-862) in the DesignThemes Directory Addon WordPress plugin (designthemes-directory-addon). It arises from exploiting incorrectly configured access control security levels and affects all versions from n/a through 1.8 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating it can be exploited remotely by unauthenticated attackers with low complexity and no user interaction. Successful exploitation enables high-impact integrity violations, such as unauthorized data modifications, while leaving confidentiality and availability unaffected.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/designthemes-directory-addon/vulnerability/wordpress-designthemes-directory-addon-plugin-1-8-broken-access-control-vulnerability?_s_id=cve) documents the broken access control issue in plugin version 1.8 and provides details relevant to mitigation for affected deployments.

Details

CWE(s)

CVEs Like This One

CVE-2026-4277Shared CWE-862
CVE-2026-3360Shared CWE-862
CVE-2026-34053Shared CWE-862
CVE-2025-1657Shared CWE-862
CVE-2025-26733Shared CWE-862
CVE-2026-27071Shared CWE-862
CVE-2025-0952Shared CWE-862
CVE-2025-24591Shared CWE-862
CVE-2026-25131Shared CWE-862
CVE-2026-27638Shared CWE-862

References