CVE-2026-32388
Missing Authorization in linethemes GLB ≤ 1.2.2 Enables Unauthorized Access
Publication date: 2026-03-13
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linethemes | glb | 1.2.3 |
| linethemes | glb | to 1.2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32388 is a Broken Access Control vulnerability in the WordPress GLB Theme versions up to and including 1.2.2. It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which allows users with limited privileges (such as Subscriber or Developer roles) to perform actions that should be restricted to higher-privileged users.
This vulnerability falls under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
The vulnerability allows users with at least Subscriber or Developer privileges to bypass intended access controls and perform unauthorized actions within the GLB Theme. This could lead to limited but unauthorized changes or access to certain functions that should be restricted.
The CVSS score of 5.4 indicates a low priority threat with limited impact and a low likelihood of exploitation.
Users are advised to update to version 1.2.3 or later of the GLB Theme to mitigate this risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability arises from missing authorization checks in certain functions of the WordPress GLB Theme up to version 1.2.2, allowing unprivileged users with at least Subscriber or Developer roles to perform unauthorized actions.'}, {'type': 'paragraph', 'content': 'Detection would involve verifying if your WordPress installation is running the GLB Theme version 1.2.2 or earlier and checking for unauthorized access attempts or privilege escalations related to theme functions.'}, {'type': 'paragraph', 'content': 'Specific commands are not provided in the available resources, but general steps include:'}, {'type': 'list_item', 'content': "Check the installed GLB Theme version via WordPress admin dashboard or by inspecting the theme's style.css file."}, {'type': 'list_item', 'content': 'Review web server logs for suspicious requests targeting GLB Theme endpoints or functions.'}, {'type': 'list_item', 'content': 'Use WordPress CLI commands such as `wp theme list` to verify theme versions.'}, {'type': 'list_item', 'content': 'Audit user roles and permissions to detect any unauthorized privilege escalations.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the WordPress GLB Theme to version 1.2.3 or later, where this vulnerability has been resolved.
Additionally, review and restrict user roles and permissions to ensure that only trusted users have Subscriber or Developer roles, as these privilege levels are required to exploit the vulnerability.
Monitoring and auditing access logs for suspicious activity related to the GLB Theme can also help in early detection and response.