CVE-2026-0676: 
WordPress vulnerability analysis and mitigation

CVE-2026-0676 is a Missing Authorization (Broken Access Control) vulnerability in the G5Theme Zorka WordPress theme that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the Zorka theme up to and including 1.5.7. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on December 9, 2025, and publicly disclosed by Patchstack on January 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) and falls under OWASP Top 10 category A1: Broken Access Control. The root cause is a missing authorization, authentication, or nonce token check in one or more theme functions, which allows unauthenticated users to invoke actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially accessible to remote attackers (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions on affected WordPress sites running the Zorka theme, resulting in a low integrity impact with no confidentiality or availability impact according to the CVSS assessment. While the individual impact per site is limited, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of their traffic or popularity (Patchstack).

No official patch is currently available for the Zorka theme as of the disclosure date, leaving all installations at version 1.5.7 and below vulnerable. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. No evidence of active in-the-wild exploitation, threat actor attribution, or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog has been reported. Patchstack classifies the priority as low and considers it unlikely to be exploited in a targeted manner, though mass-exploit campaign risk exists (Patchstack).

As of the disclosure date, no official patch has been released by G5Theme for the Zorka WordPress theme. Site administrators are advised to remove or deactivate the Zorka theme until a patched version becomes available. As an interim measure, web application firewall (WAF) rules — such as those provided by Patchstack — can be used to virtually patch the vulnerability and block exploitation attempts. Hosting providers or web developers should be consulted if an immediate theme replacement is not feasible (Patchstack).