BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-04-28

Assigner: Patchstack

Description

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-22

Last Modified

2026-04-28

Generated

2026-07-06

AI Q&A

2026-01-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22396

Affected Vendors & Products

Vendor	Product	Version / Range
mikado-themes	fiorello	From 1.0\|end_including=1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-22396 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress Fiorello Theme (versions up to 1.0). It allows attackers with at least subscriber or developer privileges to bypass authorization and authentication controls, enabling unauthorized access to sensitive files, folders, or database interactions. This is due to incorrectly configured access control security levels. [1]

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data or resources within the affected WordPress site. An attacker exploiting this flaw could view or manipulate files, folders, or database content they should not have access to, potentially compromising the confidentiality and integrity of the site data. [1]

Mitigation Strategies

Since no official fix or patched version is currently available for the Fiorello theme, immediate mitigation steps include using Patchstack's offered mitigation services to protect affected installations. Additionally, restricting user privileges to minimize the risk of exploitation and monitoring for unauthorized access attempts can help reduce exposure. [1]

Hi! I’m here to help you understand CVE-2026-22396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70