# CVE-2026-27364: AnalogWP Style Kits broken access control in subscriber role

Source: https://junglewise.ai/threats/cve-2026-27364-analogwp-style-kits-broken-access-control-in-subscriber-role  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27364 · Severity: medium · CVSS 6.5 · Published 2026-08-24

Style Kits is a WordPress plugin that allows website designers to create and manage custom style templates. Versions up to 2.6.5 contain a broken access control vulnerability that allows subscriber-level users to access or perform actions they should not be permitted to perform. An attacker with a subscriber account (the lowest privilege level) could exploit this to view restricted content or perform privileged actions on the WordPress site.

Technologies: [AnalogWP Style Kits](https://junglewise.ai/threats/technologies/style-kits). Vendors: [AnalogWP](https://junglewise.ai/threats/vendors/analogwp).

## Quick answers

**Is CVE-2026-27364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27364 being exploited in the wild.

**How severe is CVE-2026-27364?** Medium severity, with a CVSS score of 6.5, published 24 August 2026.

**Which products and versions are affected?** AnalogWP Style Kits <=2.6.5.

**Is there a fix for CVE-2026-27364?** A patch was published on 2026-08-24: Version 2.6.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27364 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-27364?** Check whether you run AnalogWP Style Kits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a broken access control flaw in the AnalogWP Style Kits WordPress plugin affecting versions 2.6.5 and earlier. The vulnerability requires subscriber-level privileges to exploit, indicating insufficient permission checks in the plugin's code. An authenticated attacker with a subscriber account can bypass access controls to perform actions or view data that should be restricted to higher-privilege users (such as administrators or editors). The vulnerability is tracked as CVE-2026-27364 with a CVSS score of 6.5. The plugin maintainers released a patch in version 2.6.6 addressing this access control issue.

## Affected products

- AnalogWP Style Kits <=2.6.5

## Timeline

- 2026-08-24: disclosed
- 2026-08-24: patched: Version 2.6.6 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/analogwp-templates/vulnerability/wordpress-style-kits-plugin-2-6-5-broken-access-control-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/analogwp-templates/vulnerability/wordpress-style-kits-plugin-2-6-5-broken-access-control-vulnerability-2?_s_id=cve)

## Related threats

- [AnalogWP Style Kits broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-65484-analogwp-style-kits-broken-access-control-in-wordpress-plugin)
- [AnalogWP Style Kits Stored XSS in kit title parameter](https://junglewise.ai/threats/cve-2026-6565-analogwp-style-kits-stored-xss-in-kit-title-parameter)