Description
Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
Published: 2026-03-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Patch
AI Analysis

Impact

The vulnerability is a missing authorization flaw in the VW School Education WordPress theme. Because of incorrectly configured access control, an attacker can gain access to resources that should be protected. This flaw is a classic "Missing Authorization" issue (CWE‑862). The potential impact is unauthorized reading, modification, or deletion of data within the WordPress installation, which could lead to disclosure of sensitive information or content tampering.

Affected Systems

Affects the VW School Education theme from vowelweb. All installations using version 1.4.6 or any earlier version are vulnerable. Versions newer than 1.4.6 are not affected as per the vendor’s notice.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate risk level. The EPSS score is less than 1%, suggesting the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, which further implies it is not a currently known, actively exploited issue. The vulnerability is exposed via the theme’s web interface, so an attacker with web access to the WordPress site could attempt exploitation; this inference is based on the typical deployment of WordPress themes.

Generated by OpenCVE AI on March 19, 2026 at 15:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for an updated version of the VW School Education theme and upgrade to any release later than 1.4.6.
  • If a newer version is not yet available, disable or remove the vulnerable theme from the WordPress installation.
  • Review user role assignments and permission settings in WordPress to ensure that only authorized users can edit or publish content.
  • Monitor the site for any unauthorized content changes or access attempts and investigate promptly.

Generated by OpenCVE AI on March 19, 2026 at 15:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Vowelweb
Vowelweb vw School Education
Wordpress
Wordpress wordpress
Vendors & Products Vowelweb
Vowelweb vw School Education
Wordpress
Wordpress wordpress

Fri, 13 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
Title WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Vowelweb Vw School Education
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-01T14:16:16.917Z

Reserved: 2026-03-12T11:11:35.693Z

Link: CVE-2026-32438

cve-icon Vulnrichment

Updated: 2026-03-13T15:43:51.934Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-13T19:55:04.027

Modified: 2026-03-16T14:53:46.157

Link: CVE-2026-32438

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T12:03:26Z

Weaknesses