CVE-2026-25460
Missing Authorization in Ave Core ≤ 2.9.1 Enables Unauthorized Access
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| liquidthemes | ave_core | to 2.9.1 (inc) |
| liquidthemes | ave_core | From 2.9.1|end_including=2.9.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25460 is a Missing Authorization vulnerability in the WordPress Ave Core Plugin versions up to and including 2.9.1. It is a Broken Access Control issue where certain plugin functions lack proper authorization, authentication, or nonce token checks.
This flaw allows unprivileged users, such as those with Subscriber or Developer roles, to perform actions that should be restricted to higher privilege levels.
The vulnerability is classified as medium severity with a CVSS score of 6.3 and falls under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability can allow attackers with low privilege levels to execute unauthorized actions within the affected WordPress plugin.
Such unauthorized access can lead to potential compromise of website functionality, data integrity, or security controls.
Because the vulnerability can be exploited in mass campaigns targeting many websites, it poses a risk regardless of the website's traffic or popularity.
No official patch is currently available, but mitigations can be applied to block attacks exploiting this flaw until a patch is released.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability arises from missing authorization checks in certain plugin functions of the WordPress Ave Core Plugin up to version 2.9.1, allowing unprivileged users to perform restricted actions.
No specific detection commands or network/system scanning instructions are provided in the available resources.
Users are advised to monitor for unusual activity from low-privilege WordPress roles such as Subscriber or Developer, which could indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, immediate mitigation involves applying the Patchstack mitigation rule designed to block attacks exploiting this flaw.
- Apply the Patchstack mitigation rule to block exploit attempts.
- Update the Ave Core Plugin immediately once an official update is released.
- Seek assistance from your hosting provider or web developer to implement available mitigations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-25460 vulnerability is a Broken Access Control issue that allows unprivileged users to perform actions reserved for higher privilege levels due to missing authorization checks.
Such unauthorized access can lead to exposure or modification of sensitive data, which may impact compliance with common standards and regulations like GDPR and HIPAA that require strict access controls and protection of personal or health information.
However, the provided information does not explicitly mention the direct impact on compliance with these standards.