CVE-2026-27364
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Style Kits versions up to 2.6.5 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
Risk Assessment
The risk includes potential privilege escalation by subscribers, leading to unauthorized changes or access to sensitive data.
Recommendation
Update Style Kits to the latest patched version immediately and review user permissions.
Other vulnerabilities in Style Kits
See all- CVE-2026-65484Medium
The Style Kits plugin versions up to 2.6.5 contain a contributor broken access control vulnerability. An attacker with contributor privileges can bypass access control mechanisms.
- CVE-2026-6565Medium
The Style Kits plugin for WordPress up to version 2.5.0 has a Stored XSS vulnerability via the kit title parameter in the '/wp-json/agwp/v1/tokens/save' endpoint. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever a user visits an infected page.
Original NVD description (English source)
Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.