CVE-2026-66588
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The The7 theme versions up to 14.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions or data.
Risk Assessment
The risk includes unauthorized access to sensitive functions and data, potentially leading to system integrity compromise or information leakage.
Recommendation
It is recommended to update the The7 theme to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in The7
See all- CVE-2025-63073Medium
DOM-Based XSS vulnerability in The7 theme by Dream-Theme. Improper input neutralization during web page generation allows client-side script injection.
- CVE-2025-11897Medium
The The7 — Website and eCommerce Builder for WordPress theme is vulnerable to Stored Cross-Site Scripting via the 'the7_fancy_title_css' parameter in all versions up to, and including, 12.9.1. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.
Original NVD description (English source)
Unauthenticated Broken Access Control in The7 <= 14.2.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS