CVE-2026-39648

The Cream Blog theme for WordPress, versions up to and including 2.1.7, suffers from a missing authorization vulnerability. This flaw stems from incorrectly configured access control security levels, which can be exploited by attackers to perform actions that should require higher privileges [1].

The attack surface is broad: no authentication is required, and the vulnerability can be exploited remotely over HTTP. Attackers can target any website running the vulnerable theme, and the issue is actively used in mass-exploit campaigns, affecting sites regardless of size or popularity [1].

Successful exploitation allows an attacker to bypass access controls and execute unauthorized actions, potentially leading to privilege escalation or other malicious operations. The severity is rated as Medium (CVSS 5.3), but the risk is elevated due to ease of exploitation and widespread use [1].

As mitigation, users should update to a patched version if available. The theme has not been updated in over a year, so replacing the theme is recommended. Deactivating the theme does not remove the security threat unless a mitigation rule (e.g., from Patchstack) is deployed [1].