CVE-2026-24612: 
WordPress vulnerability analysis and mitigation

CVE-2026-24612 is a Missing Authorization (Broken Access Control) vulnerability in the Orchid Store WordPress theme developed by themebeez. It allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized actions. The vulnerability affects all versions of the Orchid Store theme up to and including 1.5.15. It was reported by researcher John P on December 13, 2025, and published by Patchstack on January 23, 2026. The CVSS v3.1 base score is 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the Orchid Store theme fails to perform adequate authorization checks before executing certain privileged or restricted actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting the absence of proper nonce token, authentication, or capability checks. No special preconditions — such as an existing account or specific configuration — are required for exploitation. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation primarily affects integrity, allowing unauthenticated attackers to perform unauthorized actions that would normally require elevated privileges within the WordPress site. Confidentiality and availability impacts are assessed as none by Patchstack's final scoring (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The scope is limited to the affected WordPress installation running the vulnerable theme, with no evidence of lateral movement potential beyond the site's own functionality (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-24612. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, though this specific issue is rated low priority with unlikely exploitation impact (Patchstack).

As of the time of disclosure, no official patch is available for the Orchid Store theme — the theme has not been updated in over three months and is unlikely to receive further updates. Patchstack recommends removing and replacing the theme as the primary remediation step. Users of the Patchstack security platform can deploy a virtual patching/mitigation rule to block exploitation without removing the theme. Site owners unable to act immediately should consult their hosting provider or web developer (Patchstack).