Description
Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escalation.This issue affects Sale! Immigration law, Visa services support, Migration Agent Consulting: from n/a through <= 1.5.8.
Published: 2025-12-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An incorrect privilege assignment flaw exists in the Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting WordPress theme, which allows an attacker to elevate privileges. The weakness is classified as CWE-266 and can lead to unauthorized higher level access to the site, enabling further compromise or damage.

Affected Systems

The vulnerability affects the WordPress theme named Sale! Immigration law, Visa services support, Migration Agent Consulting (immiex) from its initial release up to and including version 1.5.8. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that a user with a limited role can trigger the theme’s code to gain higher privileges through the web interface, potentially allowing full site compromise.

Generated by OpenCVE AI on April 29, 2026 at 13:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the theme to a version newer than 1.5.8, if such a release is available from the vendor.
  • If no newer version exists, deactivate or remove the theme from the WordPress installation and revert to the default theme.
  • Audit the site’s user roles and capabilities, removing any extra permissions granted by the theme and ensuring that each role follows the principle of least privilege.

Generated by OpenCVE AI on April 29, 2026 at 13:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Fri, 19 Dec 2025 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 18 Dec 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 18 Dec 2025 07:45:00 +0000

Type Values Removed Values Added
Description Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escalation.This issue affects Sale! Immigration law, Visa services support, Migration Agent Consulting: from n/a through <= 1.5.8.
Title WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerability
Weaknesses CWE-266
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T20:19:21.230Z

Reserved: 2025-09-09T14:47:17.697Z

Link: CVE-2025-59134

cve-icon Vulnrichment

Updated: 2025-12-18T15:48:52.369Z

cve-icon NVD

Status : Deferred

Published: 2025-12-18T08:16:03.193

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-59134

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T13:15:11Z

Weaknesses