CVE-2026-25009

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25009", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-28T09:51:50.023Z", "datePublished": "2026-03-25T16:14:37.014Z", "dateUpdated": "2026-04-28T16:14:53.256Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "education-zone", "product": "Education Zone", "vendor": "raratheme", "versions": [{"changes": [{"at": "1.3.9", "status": "unaffected"}], "lessThanOrEqual": "1.3.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "John P | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:18:30.635Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Education Zone: from n/a through <= 1.3.8.</p>"}], "value": "Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:53.256Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Theme/education-zone/vulnerability/wordpress-education-zone-theme-1-3-8-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T16:32:22.769007Z", "id": "CVE-2026-25009", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T20:10:05.214Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T16:32:22.769007Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T16:32:23.730Z"}}], "cna": {"title": "WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "John P | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "raratheme", "product": "Education Zone", "versions": [{"status": "affected", "changes": [{"at": "1.3.9", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.8"}], "packageName": "education-zone", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:18:30.635Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Theme/education-zone/vulnerability/wordpress-education-zone-theme-1-3-8-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Education Zone: from n/a through <= 1.3.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:07.646Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25009", "state": "PUBLISHED", "dateUpdated": "2026-04-27T20:10:05.214Z", "dateReserved": "2026-01-28T09:51:50.023Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:37.014Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "education-zone", "product": "Education Zone", "vendor": "raratheme", "versions": [{"changes": [{"at": "1.3.9", "status": "unaffected"}], "lessThanOrEqual": "1.3.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en raratheme Education Zone education-zone permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Education Zone: desde n/a hasta &lt;= 1.3.8."}], "id": "CVE-2026-25009", "lastModified": "2026-06-17T10:23:58.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25009", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T16:32:22.769007Z", "version": "2.0.3"}}]}, "published": "2026-03-25T17:16:41.743", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Theme/education-zone/vulnerability/wordpress-education-zone-theme-1-3-8-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.8]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.3.9"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "Education Zone", "source": "cna", "vendor": "raratheme"}, "product": "education_zone", "vendor": "rarathemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-26T18:47:02.995559+00:00", "value": {"mitigation_remediation": ["Update raratheme Education Zone theme to version\u00a01.3.9 or later.", "Verify that the updated theme is active and no older versions remain.", "Restrict theme editor and file editing permissions in the WordPress to prevent unauthorized changes."], "summary": {"action": "Apply Patch", "impact": "Broken Access Control"}, "threat_synthesis": {"affected_systems": "The flaw exists in all installations of the raratheme Education Zone theme up to and including version\u00a01.3.8. WordPress sites that have not yet upgraded to a patched version\u2014typically those running versions of the theme from its initial release through\u00a01.3.8\u2014are affected.", "description_and_impact": "A missing authorization check in the raratheme Education Zone WordPress theme allows an attacker to bypass normal access controls and reach areas that should be restricted. This vulnerability can enable unauthorized users to view or modify sensitive site content, configuration settings, or administrative functions, potentially leading to defacement, data leakage, or further compromise. The weakness is a classic Missing Authorization issue, identified as CWE\u2011862.", "risk_and_exploitability": "The CVSS base score of 6.5 indicates a medium severity vulnerability. The EPSS score of less than 1\u202f% suggests that exploitation of this flaw is unlikely to be widespread at present, and the vulnerability is not yet recorded in the CISA KEV catalog. While the exact attack vector is not detailed in the description, the missing authorization check implies that an unauthenticated or low\u2011privileged user could exploit the flaw remotely by submitting crafted requests to the site. Deployment of a patch or update is therefore strongly recommended."}}}}, "created": "2026-03-25T21:34:21.573481+00:00", "updated": "2026-03-27T09:46:12.133303+00:00", "vendors": ["rarathemes", "rarathemes$PRODUCT$education_zone", "wordpress", "wordpress$PRODUCT$wordpress"]}