CVE-2026-59535: Thrive Themes Thrive Product Manager broken access control

CVE-2026-59535 · Severity: high · CVSS 7.3 · Published 2026-07-27

Thrive Product Manager, a WordPress plugin used to manage and license Thrive Themes products, contains a security flaw that allows unauthorized individuals to perform actions they should not have access to. An attacker could exploit this to bypass security restrictions, potentially leading to unauthorized changes or access to site data. This vulnerability is considered high priority as it does not require a password to exploit and could be used in automated attacks against WordPress websites.

Vendors: Thrive Themes.

Quick answers

Is CVE-2026-59535 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59535 being exploited in the wild.
How severe is CVE-2026-59535?
High severity, with a CVSS score of 7.3, published 27 July 2026.
Which products and versions are affected?
Thrive Themes Thrive Product Manager <= 10.9.2.
Is there a fix for CVE-2026-59535?
A patch was published on 2026-07-27: Version 10.9.2.1 confirmed as patched version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59535 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-59535?
Check whether you run Thrive Themes Thrive Product Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability (CWE-862: Missing Authorization) exists in the Thrive Product Manager plugin for WordPress in versions up to and including 10.9.2. The flaw stems from a lack of proper authorization, authentication, or nonce checks in certain functions, allowing an unauthenticated remote attacker to execute privileged actions. Successful exploitation could impact the confidentiality, integrity, and availability of the affected site. The issue is resolved in version 10.9.2.1.

Affected products

  • Thrive Themes Thrive Product Manager <= 10.9.2

Timeline

  • 2026-05-26: disclosed: Reported by Austin Ginder
  • 2026-07-23: advisory: Patchstack advisory published
  • 2026-07-27: advisory: NVD published date
  • 2026-07-27: patched: Version 10.9.2.1 confirmed as patched version

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.