CVE-2026-22447: 
WordPress vulnerability analysis and mitigation

CVE-2026-22447 is a Missing Authorization (Broken Access Control) vulnerability in the Select-Themes Prowess WordPress theme. It affects all versions up to and including 1.8.1, allowing unauthenticated network-based attackers to exploit incorrectly configured access control security levels. The vulnerability was published on January 22, 2026, and reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity on December 4, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, and a CVSS score of 4.3 (Low) per Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), where the Prowess theme fails to perform adequate authorization checks on one or more functions that should be restricted to privileged users. This allows unauthenticated attackers to invoke higher-privileged actions without proper authentication or nonce token validation — a pattern consistent with Broken Access Control (OWASP Top 10: A1). No specific technical write-up or proof-of-concept code has been publicly disclosed at this time (Patchstack).

Successful exploitation allows unauthenticated remote attackers to perform unauthorized actions that would normally require elevated privileges, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress installation running the vulnerable Prowess theme. While the individual impact per site is limited, this class of vulnerability is commonly leveraged in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No official patch is currently available for the Prowess theme, leaving all installations on version 1.8.1 and below exposed. The EPSS score is 0.017% (0.000170), indicating a low probability of exploitation in the near term. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported for this vulnerability. Patchstack classifies the priority as Low, noting it is unlikely to be actively exploited in targeted attacks, though mass-exploit campaigns against WordPress themes remain a general risk (Patchstack).

As of the time of publication, no official patched version of the Prowess theme is available from Select-Themes. Site administrators are advised to deactivate and remove the Prowess theme until a patch is released. Alternatively, a Web Application Firewall (WAF) such as Patchstack's virtual patching solution can be used to block exploitation attempts without requiring a code-level fix. Users should monitor the Patchstack vulnerability database and the theme developer's repository for patch availability (Patchstack).