Description
Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.
Published: 2026-03-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Access Control Bypass
Action: Patch Immediately
AI Analysis

Impact

This vulnerability is a Missing Authorization issue in raratheme The Minimal, allowing attackers to exploit incorrectly configured access control security levels. The result is a potential bypass of normal privilege restrictions, so an attacker could perform actions normally reserved for privileged users. The weakness is formally identified as CWE-862 (Missing Authorization).

Affected Systems

The Minimal theme for WordPress, version 1.2.9 and earlier, is affected. The CVE impact applies to all installations of the theme up to and including version 1.2.9; newer releases are not known to be affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1%, implying a low probability that an exploit is actively used. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, through a web-facing WordPress installation that has the vulnerable theme enabled and misconfigured access controls.

Generated by OpenCVE AI on March 19, 2026 at 14:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update The Minimal theme to a version newer than 1.2.9 if an update is available.
  • If no update is available, disable the theme until a patch is released or access to the vulnerable functionality is restricted.
  • Monitor the theme developer’s website or relevant advisories for an official fix.

Generated by OpenCVE AI on March 19, 2026 at 14:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Raratheme
Raratheme the Minimal
Wordpress
Wordpress wordpress
Vendors & Products Raratheme
Raratheme the Minimal
Wordpress
Wordpress wordpress

Fri, 13 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.
Title WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Raratheme The Minimal
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-01T14:16:02.681Z

Reserved: 2026-03-12T11:10:59.412Z

Link: CVE-2026-32374

cve-icon Vulnrichment

Updated: 2026-03-13T18:45:16.326Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-13T19:54:51.940

Modified: 2026-03-16T14:53:46.157

Link: CVE-2026-32374

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T12:05:12Z

Weaknesses