CVE-2026-42705

Received Received - Intake

Unauthenticated Broken Access Control in Grand News

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-42705

EUVD

EUVD-2026-96442

Affected Vendors & Products

Vendor	Product	Version / Range
ThemeGoods	Grand	News n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-42705 is an unauthenticated broken access control vulnerability in the WordPress Grand News Theme versions 3.4 or lower. This means attackers can access restricted pages or perform unauthorized actions without logging in, potentially exposing sensitive data.

Detection Guidance

Check for unauthorized access to restricted pages or unusual activity in web server logs. Monitor for requests targeting Grand News Theme versions 3.4 or lower. Use security plugins to scan for Broken Access Control patterns.

Impact Analysis

This vulnerability allows unauthenticated users to access restricted pages or perform unauthorized actions, which could lead to exposure of sensitive data. It is actively exploited in mass campaigns, putting thousands of websites at risk. There is no official patch yet, so mitigation is required.

Mitigation Strategies

Apply Patchstack's temporary mitigation rule if available. Disable or remove the Grand News Theme version 3.4 or lower. Restrict access to sensitive pages via server configuration. Monitor for exploitation attempts.

Hi! I’m here to help you understand CVE-2026-42705. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70