CVE-2026-27046
Missing Authorization in Kaira StoreCustomizer ≤ 2.6.3 Allows Unauthorized Access
Publication date: 2026-03-25
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kaira | storecustomizer | to 2.6.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27046 is a medium severity Broken Access Control vulnerability found in the WordPress StoreCustomizer Plugin versions up to and including 2.6.3.
The vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions. This flaw allows unprivileged users, such as subscribers or developers, to perform actions that should be restricted to higher privileged roles.
It is classified under OWASP Top 10 A1: Broken Access Control and has a CVSS score of 6.5, indicating a moderate risk.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to escalate their privileges within the WordPress site using the StoreCustomizer plugin.
Such unauthorized privilege escalation can lead to unauthorized actions being performed, potentially compromising the integrity and security of the website.
Because the vulnerability can be exploited in mass-attack campaigns targeting many websites regardless of their traffic or popularity, it poses a significant risk to affected sites.
Currently, no official patch is available, but mitigation rules can be applied to block attacks exploiting this flaw until a fix is released.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about commands or methods to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, immediate mitigation involves applying the mitigation rule issued by Patchstack to block attacks exploiting this flaw.
Users are advised to update the StoreCustomizer plugin immediately once a patch is released.
It is also recommended to seek assistance from your hosting provider or web developer to implement these mitigation measures effectively.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the StoreCustomizer plugin involves broken access control, allowing unauthorized users to perform actions reserved for higher privileged roles. Such unauthorized access can lead to potential data breaches or unauthorized data manipulation.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, broken access control vulnerabilities generally pose risks to data confidentiality and integrity, which are critical requirements under these regulations.
Therefore, exploitation of this vulnerability could potentially lead to non-compliance with regulations that mandate strict access controls and protection of sensitive data.