What the vulnerability does
01Description
Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea WP: from n/a through 1.0.13; Elevate WP: from n/a through 1.0.15; Brite: from n/a through 1.0.11; Colibri WP: from n/a through 1.0.94; Vertice: from n/a through 1.0.7.
Explanation of Vulnerability in Simple Terms
02Summary
Pathway versions up to 1.0.15 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data integrity without elevated permissions. The vulnerability affects the product's access control mechanism and requires an active user session to exploit.
What an attacker can do
03Attacker Capabilities
Modify content or data they should not have permission to change.
Potential impact on your site
04Site Impact
Unauthorized users can alter site content, potentially corrupting data or defacing pages.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges on the site.
Key dates
06Disclosure timeline
April 29, 2024
CVE published
April 28, 2026
Record updated
