Unauthenticated Broken Access Control in Koji

Executive Summary

CVE-2026-74020 is an Unauthenticated Broken Access Control vulnerability in the WordPress Koji Theme versions 2.2.1 and below. It allows unauthenticated attackers to perform privileged actions due to missing authorization checks, posing a high risk of exploitation with a CVSS score of 7.5.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if the Koji theme version 2.2.1 or below is installed on your WordPress site. You can verify the theme version via the WordPress admin dashboard under Appearance > Themes or by inspecting the theme's style.css file. No specific commands are provided in the resources, but monitoring for unauthorized privileged actions or unusual activity may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may allow attackers to perform unauthorized privileged actions on affected websites. It is actively dangerous and could be exploited in mass campaigns targeting thousands of sites. Immediate action is recommended to mitigate risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to perform privileged actions due to missing authorization checks, which could lead to unauthorized data access or modification. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by exposing sensitive user data without proper controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply the mitigation rule provided by Patchstack to block attacks until an official patch is released. Update the Koji theme to the latest version if available. If no update exists, contact your hosting provider or a developer for assistance. Remove or disable the theme if it is not actively used.

Useful 0 Not Useful 0