Unauthenticated Broken Access Control in Civi

Executive Summary

CVE-2026-65476 is an Unauthenticated Broken Access Control vulnerability in the WordPress Civi Theme versions 2.2.4 and earlier. This means the software fails to properly restrict access to certain functions, allowing unauthorized users to perform actions they should not be able to. The flaw enables low-privilege users to access or modify data or settings reserved for higher-privilege users.

Useful 0 Not Useful 0

Detection Guidance

Since no official patch exists and the vulnerability is classified as low severity, detection primarily involves checking if the Civi Theme version 2.2.4 or earlier is installed on your WordPress site. You can verify this by accessing your WordPress admin dashboard, navigating to Appearance > Themes, and checking the version of the Civi Theme.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to perform unauthorized actions on your WordPress site, such as modifying content, changing settings, or accessing sensitive data. Since it is unauthenticated, attackers do not need valid credentials to exploit it. The impact is considered low severity, but users should still take precautions to prevent potential misuse.

Useful 0 Not Useful 0

Compliance Impact

Broken Access Control vulnerabilities can lead to unauthorized data access or modification, which may violate compliance requirements under GDPR or HIPAA. If exploited, this flaw could result in unauthorized exposure of personal or sensitive data, potentially leading to legal penalties or reputational damage. Immediate mitigation is recommended to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Civi Theme to the latest version if available. If no update is available, contact your hosting provider or web developer for assistance. As a temporary measure, consider disabling the Civi Theme if it is not essential to your site's functionality.

Useful 0 Not Useful 0