# CVE-2026-57405: ThemeHunk Open Shop missing authorization in WordPress theme

Source: https://junglewise.ai/threats/cve-2026-57405-themehunk-open-shop-missing-authorization-in-wordpress-theme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-57405 · Severity: high · CVSS 7.1 · Published 2026-07-13

The Open Shop theme for WordPress, which is used to build e-commerce websites, contains a security flaw in its access control settings. This vulnerability allows logged-in users with low-level permissions, such as customers or subscribers, to perform actions they should not be authorized to do. An exploit could lead to unauthorized changes to the website's configuration or cause service disruptions, potentially impacting store operations and reputation.

Vendors: [ThemeHunk](https://junglewise.ai/threats/vendors/themehunk).

## Quick answers

**Is CVE-2026-57405 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57405 being exploited in the wild.

**How severe is CVE-2026-57405?** High severity, with a CVSS score of 7.1, published 13 July 2026.

**Which products and versions are affected?** ThemeHunk Open Shop <= 1.7.1.

**Is there a fix for CVE-2026-57405?** A patch was published on 2026-07-13: Version 1.7.2 confirmed as patched version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57405 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57405?** Check whether you run ThemeHunk Open Shop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Broken Access Control vulnerability (CWE-862) exists in the ThemeHunk Open Shop theme through version 1.7.1. The flaw stems from missing authorization checks or incorrectly configured access control levels within the theme's functions. An attacker authenticated with basic 'Subscriber' privileges can exploit this to execute higher-privileged actions. While the specific functions affected are not detailed, the CVSS vector indicates a high impact on availability and a low impact on integrity. The issue is resolved in version 1.7.2.

## Affected products

- ThemeHunk Open Shop <= 1.7.1

## Timeline

- 2026-04-29: disclosed: Reported by HaiND to Patchstack
- 2026-07-08: advisory: Patchstack published advisory
- 2026-07-13: advisory: NVD published CVE record
- 2026-07-13: patched: Version 1.7.2 confirmed as patched version

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Theme/open-shop/vulnerability/wordpress-open-shop-theme-1-7-1-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Theme/open-shop/vulnerability/wordpress-open-shop-theme-1-7-1-broken-access-control-vulnerability?_s_id=cve)