CVE-2026-25367: 
WordPress vulnerability analysis and mitigation

CVE-2026-25367 is a Missing Authorization (Broken Access Control) vulnerability in the NooTheme CitiLights WordPress theme (noo-citilights). It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized actions. The vulnerability affects CitiLights versions from n/a through versions prior to 3.7.2. It carries a CVSS v3.1 base score of 5.3 (Medium), and was published on February 19, 2026 (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the theme fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or exposing functionality. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability falls under the broader category of Broken Access Control, where improperly configured security levels allow unauthorized users to invoke restricted functionality within the WordPress theme (Feedly).

Successful exploitation results in a low integrity impact — attackers can perform unauthorized actions within the affected WordPress site, such as modifying data or invoking restricted theme functionality, without requiring any credentials. There is no direct confidentiality or availability impact as assessed by the CVSS score. The scope is limited to the affected WordPress installation running the CitiLights theme, with no evidence of lateral movement potential beyond the theme's functionality (Feedly).

The vulnerability has a very low EPSS score of approximately 0.017%, indicating a low probability of active exploitation in the near term. No public proof-of-concept exploit code, exploit kit integration, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users of the NooTheme CitiLights WordPress theme should update to version 3.7.2 or later, which addresses this missing authorization issue. No specific configuration-based workarounds have been publicly documented. As a general best practice, WordPress site administrators should ensure all themes and plugins are kept up to date and restrict theme functionality to authenticated users where possible (Patchstack).