Subscriber Broken Access Control in Werkstatt <= 4.7.2

Executive Summary

CVE-2026-57689 is a Broken Access Control vulnerability in the WordPress Werkstatt Theme versions up to and including 4.7.2.

This vulnerability allows unprivileged users, such as those with a Subscriber role, to perform actions that normally require higher privileges because of missing authorization, authentication, or nonce token checks.

It is classified as low severity with a CVSS score of 4.3 and currently has no official patch or fix.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with low-level access (such as Subscribers) to perform unauthorized actions that should be restricted to higher privilege users.

Although the risk is considered low, attackers may exploit this vulnerability in mass campaigns targeting thousands of websites, potentially leading to unauthorized changes or access.

Immediate action is recommended, such as updating the theme or seeking assistance from a hosting provider or developer to mitigate the risk.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in the WordPress Werkstatt Theme (versions up to 4.7.2) is not yet patched and no official fix is available.

Immediate recommended actions include updating the theme if a newer version becomes available or seeking assistance from your hosting provider or a developer to implement custom mitigations.

Useful 0 Not Useful 0