Quick answers
- Is CVE-2026-27433 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-27433 being exploited in the wild.
- How severe is CVE-2026-27433?
- Medium severity, with a CVSS score of 6.5, published 2 July 2026.
- Which products and versions are affected?
- StylemixThemes Motors <= 5.6.80.
- Is there a fix for CVE-2026-27433?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-27433 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-27433?
- Check whether you run StylemixThemes Motors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Motors theme for WordPress (versions up to and including 5.6.80) suffers from a broken access control vulnerability due to missing authorization checks (CWE-862). This flaw allows an unauthenticated remote attacker to execute functions that should be restricted to higher-privileged users. The attack vector is network-based and requires no user interaction or prior authentication. Successful exploitation can lead to unauthorized integrity changes or availability impacts on the affected WordPress site. As of the advisory date, no official patch has been released by the developer.
Affected products
- StylemixThemes Motors <= 5.6.80
Timeline
- 2025-10-15: disclosed: Reported by Rafie Muhammad to Patchstack
- 2026-06-30: advisory: Initial advisory published by Patchstack
- 2026-07-02: other: CVE record published and added to NVD dataset