CVE-2026-22398
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mikado-themes | fleur | From 2.0|end_including=2.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-22398 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress Fleur Theme up to version 2.0. It allows attackers with subscriber or developer privileges to bypass authorization and authentication controls, potentially gaining unauthorized access to sensitive files, folders, or database interactions. This is due to incorrectly configured access control security levels. [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to access sensitive data or resources that should be protected, potentially leading to data exposure or manipulation. However, exploitation requires at least subscriber or developer privileges, and the vulnerability is considered low severity with a CVSS score of 5.4. It is unlikely to be exploited according to Patchstack. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix is currently available for this vulnerability, immediate mitigation steps include restricting subscriber or developer privileges to trusted users only, monitoring access to sensitive files and folders, and applying strict access control policies to prevent unauthorized access. Additionally, consider disabling or replacing the Fleur theme until a patch is released. [1]