CVE-2026-65524 MEDIUM

CVE-2026-65524: WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Vendor Themefusion
Product Avada Custom Branding
Weakness CWE-862 · Missing authorization
Published July 23, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Avada Custom Branding versions up to 1.2 lack proper authorization checks, allowing authenticated users with low privileges to view sensitive branding configuration data they should not access. The vulnerability requires a valid user account but no special interaction. This affects confidentiality only; data cannot be modified or the site disrupted.

What an attacker can do

03Attacker Capabilities

Read branding configuration data that should be restricted to administrators.

Potential impact on your site

04Site Impact

Unauthorized users can access sensitive branding settings; no data loss or site disruption risk.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges on the site.

Key dates

06Disclosure timeline

July 23, 2026 CVE published
July 23, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-27422 WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability CVE-2026-61973 WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability CVE-2026-65453 WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability CVE-2026-27399 WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability CVE-2026-65489 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability