◆ CVE Hub

CVE-2026-107887

SSVC: none

Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

Published
2026-10-24
Last modified
2026-10-24
CNA
WPScan
NVD status
Received
CWE
CWE-862

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
5.4
MEDIUM
Scored by CISA-ADP (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.1%
Percentile 2.2%
as of 2026-10-24
CISA KEV
—
Not listed
SSVC (CISA ADP)
none
Automatable: no / Impact: partial

Attack conditions and impact

Derived from the CISA-ADP (via NVD) CVSS 3.1 vector
NetworkLoginNo interaction Confidentiality NIntegrity LAvailability L
MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Privileges required PRLRegular user
User interaction UINNone
Scope SUUnchanged
Confidentiality CNNone
Integrity ILLow
Availability ALLow
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Description

NVD

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.

CVSS assessments

ProviderVersionScoreVector
NVD / 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)3.15.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
ADP / CISA-ADP3.15.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownAdvanced Twenty Seventeen
affected: 0 … <= 1.3.1
default: unknown

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (1)