Description

Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T22:16:51.380Z",
  "pubdate": "2026-08-24T22:16:51.380Z",
  "executiveSummary": "A broken access control vulnerability has been identified in the Style Kits plugin, affecting all versions up to and including 2.6.5. This security flaw introduces severe risk implications by allowing low-privileged authenticated users, specifically those assigned the subscriber role, to perform unauthorized actions restricted to higher-privileged administrators or editors. The vulnerability stems from insufficient permission checks within the application logic, which fails to properly validate whether the requesting user possesses the necessary capabilities before executing sensitive functionalities. An attacker with minimal access capabilities, such as a standard subscriber account, can leverage this weakness to interact with endpoints or manipulate data beyond their intended permission scope. Depending on the specific backend handlers exposed by the vulnerable component, successful exploitation could lead to unauthorized configuration modifications, data tampering, or state changes within the WordPress environment. The exploitation requirement is limited to authenticated low-level access, meaning an attacker must first obtain a subscriber-level account to interact with the vulnerable routines. Remediation requires updating the affected product to a patched version once available or applying strict capability checks to secure the broken access control points.",
  "technicalDetails": "The vulnerability is classified as a Broken Access Control flaw residing within the request handling architecture of the Style Kits plugin for versions <= 2.6.5. The root cause of the issue is the absence of robust authorization checks, specifically the omission of proper capability verification functions such as current_user_can() before processing administrative requests. In WordPress application security, modular components must explicitly validate user roles and capabilities prior to executing state-changing operations or rendering sensitive administrative features. Because these validation checks are missing or improperly implemented, the application implicitly trusts incoming requests originating from authenticated sessions, regardless of the user's assigned role. Consequently, a user authenticated with low-level privileges, such as a subscriber, can interact with backend functions that should strictly be restricted to administrators. The attack flow begins with an authenticated attacker sending a crafted HTTP request directly to the vulnerable plugin endpoints or AJAX/REST handlers. Due to the lack of strict privilege verification, the backend code processes the request, assuming authorized context based solely on the presence of an active user session. Depending on the functionality exposed by the vulnerable component, the payload behavior may result in unauthorized updates to site settings, style configurations, or other protected resources managed by the plugin. The network exposure is constrained by the requirement of authentication, necessitating that the threat actor possesses a valid subscriber account to initiate the request sequence. Post-exploitation impact varies depending on the specific capabilities exposed by the affected code paths, but generally involves privilege abuse, unauthorized administrative actions, and potential degradation of site integrity. Because the plugin processes requests without validating granular permissions, the broken access control mechanism completely undermines the principle of least privilege within the affected WordPress environment."
}