CVE-2026-23974: 
WordPress vulnerability analysis and mitigation

CVE-2026-23974 is a Missing Authorization (Broken Access Control) vulnerability in the uxper Golo WordPress theme that allows unauthenticated network attackers to exploit incorrectly configured access control security levels. It affects all Golo theme versions prior to 1.7.5. The vulnerability was reported on January 6, 2026, disclosed by Patchstack on January 22, 2026, and published in the NVD on the same date. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the Golo theme fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting incorrectly configured access control security levels. No user interaction is required, and attack complexity is low. The vulnerability was discovered by researcher João Pedro S Alcântara (Kinorth) and reported to Patchstack (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions that should require elevated privileges, resulting in a low integrity impact with no direct confidentiality or availability impact per the CVSS scoring. In practice, broken access control vulnerabilities of this type can enable unauthorized data modification or access to restricted WordPress theme functionality. The scope is limited to the affected WordPress installation running the vulnerable Golo theme (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The primary remediation is to update the Golo WordPress theme to version 1.7.5 or later, which contains the fix for this missing authorization issue. Site administrators unable to update immediately should consult their hosting provider or web developer for assistance. Additionally, reviewing and auditing access control configurations within the Golo theme installation and monitoring for suspicious requests from unauthenticated users targeting restricted theme functionality is recommended (Patchstack).

Wordfence included CVE-2026-23974 in its weekly WordPress vulnerability report for the period of February 2–8, 2026, highlighting it as part of broader WordPress ecosystem security coverage. No significant independent researcher commentary or notable media coverage beyond standard vulnerability tracking has been observed for this vulnerability.