CVE-2025-69331 MEDIUM

CVE-2025-69331: WordPress Theater for WordPress plugin <= 0.19 - Broken Access Control vulnerability

Vendor Jeroen Schmit
Product Theater for WordPress
Weakness CWE-862 · Missing authorization
Published January 6, 2026
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.19.

Key dates

02Disclosure timeline

January 6, 2026 CVE published
April 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-56001 WordPress Ksher plugin <= 1.1.1 - Broken Access Control vulnerability CVE-2026-12119 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute CVE-2023-51516 WordPress Business Directory Plugin – Easy Listing Directories for WordPress plugin <= 6.3.9 - Broken Access Control vulnerability CVE-2026-30889 Discourse has Unauthorized Post Data Exposure in discourse-user-notes CVE-2024-1653 Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition