CVE-2026-22409
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mikado-themes | justicia | to 1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22409 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress Justicia Theme up to version 1.2. It allows attackers with at least subscriber or developer privileges to bypass authorization and authentication controls, potentially gaining unauthorized access to sensitive files, folders, or database interactions. This is due to incorrectly configured access control security levels. [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to access sensitive information or perform actions they should not be allowed to, such as viewing or modifying files and database content. However, the severity is considered low (CVSS score 5.4), and exploitation is unlikely. Still, it poses a risk of data exposure or unauthorized data manipulation if exploited. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is currently available for this vulnerability, immediate mitigation steps include restricting user privileges to the minimum necessary (avoiding subscriber or developer roles if possible), monitoring for unauthorized access attempts, and using security intelligence services such as those provided by Patchstack to help detect and mitigate exploitation attempts. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.