Cyber Resilience

CVE-2026-27386

High

Published: 05 March 2026

Published
05 March 2026
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0004 13.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27386 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-27386 is a missing authorization vulnerability (CWE-862) in the DesignThemes Directory Addon WordPress plugin (designthemes-directory-addon). It arises from exploiting incorrectly configured access control security levels and affects all versions from n/a through 1.8 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating it can be exploited remotely by unauthenticated attackers with low complexity and no user interaction. Successful exploitation enables high-impact integrity violations, such as unauthorized data modifications, while leaving confidentiality and availability unaffected.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/designthemes-directory-addon/vulnerability/wordpress-designthemes-directory-addon-plugin-1-8-broken-access-control-vulnerability?_s_id=cve) documents the broken access control issue in plugin version 1.8 and provides details relevant to mitigation for affected deployments.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

Broken access control (CWE-862) in a public-facing WordPress plugin is directly exploitable remotely without authentication (T1190); successful exploitation enables high-integrity unauthorized modifications to stored data (T1565.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-0952Shared CWE-862
CVE-2025-24591Shared CWE-862
CVE-2026-34053Shared CWE-862
CVE-2026-3360Shared CWE-862
CVE-2026-4277Shared CWE-862
CVE-2025-1657Shared CWE-862
CVE-2026-27071Shared CWE-862
CVE-2025-26733Shared CWE-862
CVE-2026-25131Shared CWE-862
CVE-2026-4283Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces approved authorizations for logical access, mitigating the missing authorization and broken access control in the DesignThemes Directory Addon plugin.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of flaws like CVE-2026-27386 in affected plugin versions up to 1.8.

CM-6 Configuration Settings partial match
prevent

Ensures secure configuration settings for access controls, addressing the incorrectly configured security levels exploited in this vulnerability.

References