CVE-2026-22404
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mikado-themes | innovio | From 1.0 (inc) to 1.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting subscriber-level privileges carefully, monitoring for unauthorized access attempts, and using Patchstack's mitigation services as no official patch or fixed version is currently available for this vulnerability. [1]
Can you explain this vulnerability to me?
CVE-2026-22404 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress Innovio Theme versions up to and including 1.7. It allows a malicious actor to bypass authorization and authentication mechanisms by exploiting incorrectly configured access control security levels, potentially granting unauthorized access to sensitive files, folders, or database interactions. The vulnerability requires at least subscriber-level privileges to exploit. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to bypass access controls and gain access to sensitive files, folders, or database information that should be protected. Although the severity is considered low (CVSS score 5.4) and exploitation is unlikely, it still poses a risk of unauthorized data exposure or manipulation within the affected WordPress theme. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network/system detection methods provided for this vulnerability. Detection would likely require manual inspection of the Innovio theme version (up to 1.7) and checking for unauthorized access attempts, but no explicit commands or automated detection techniques are mentioned. [1]