CVE-2026-23974CWE-862

WordPress Golo theme < 1.7.5 - Broken Access Control vulnerability

Medium · published January 22, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

⚠️ A missing authorization check could let users in where they shouldn't be — like an unmonitored door to a restricted area! Think of it as a restaurant where anyone can walk into the kitchen just because they have a reservation. With the wrong access controls, unauthorized guests could reach sensitive areas, like confidential recipes or staff-only zones. If exploited, this vulnerability allows an unauthorized user to access restricted functionalities within the Golo framework. Imagine the chaos of someone tampering with sensitive data or altering configurations without anyone noticing!

Put simply

Think of it as a restaurant where anyone can walk into the kitchen just because they have a reservation. With the wrong access controls, unauthorized guests could reach sensitive areas, like confidential recipes or staff-only zones. This vulnerability arises from incorrectly configured access control security levels, allowing unauthorized access to certain features in versions of Golo before 1.7.5.

What to do

If exploited, this vulnerability allows an unauthorized user to access restricted functionalities within the Golo framework. Imagine the chaos of someone tampering with sensitive data or altering configurations without anyone noticing! To fix this, ensure your Golo installation is updated to version 1.7.5 or later. Conduct a thorough review of the access control configurations to tighten security and prevent unauthorized access. You've got this! By following these steps, you'll help keep the Golo framework secure and user data safe! 🛡️

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Golo theme < 1.7.5 - Broken Access Control vulnerability
    cvelistv5