Junglewise Threat Intelligence

CVE-2026-12471: Spexo WordPress Theme missing authorization in activate_plugin function

CVE-2026-12471 · Severity: medium · CVSS 4.3 · Published 2026-06-27

Executive brief

The Spexo theme for WordPress, which is used to design and manage the appearance of websites, contains a security flaw that allows low-level users to perform administrative actions. Specifically, an attacker with a basic 'Subscriber' account can activate certain plugins on the site without permission. While this does not directly expose sensitive data, it allows unauthorized changes to the website's configuration and functionality.

Technical details

The vulnerability is classified as a Missing Authorization (CWE-862) issue within the Spexo theme's plugin activation logic. Specifically, the 'activate_plugin' function in the 'class-welcome-notice.php' file fails to implement proper capability checks (such as current_user_can). This allows an authenticated user with minimal privileges, such as a Subscriber, to trigger the activation of a predefined set of plugins via a network request. The attack vector is network-based and requires basic authentication but no user interaction. A patch appears to be available in versions following 2.0.11, as indicated by the changeset references.

Affected products

  • templatescoderthemes Spexo up to, and including, 2.0.11

Timeline

  • 2026-06-27: advisory: NVD and Wordfence published the vulnerability details.
  • 2026-06-27: disclosed

References