CVE-2026-39648

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Cream Blog WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.

Risk Assessment

An unauthorized user can modify theme settings or access administrative functions, potentially leading to website defacement.

Recommendation

Update the Cream Blog theme to the latest version and verify permission configuration.

Original NVD description (English source)

Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.