# CVE-2026-65435: Thrive Themes Thrive Leads broken access control

Source: https://junglewise.ai/threats/cve-2026-65435-thrive-themes-thrive-leads-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-65435 · Severity: medium · CVSS 6.5 · Published 2026-07-27

Thrive Leads, a popular WordPress plugin used for building mailing lists and conversion forms, contains a security flaw that allows unauthorized users to perform actions they should not have access to. An attacker could exploit this to modify settings or disrupt the plugin's functionality without needing a password. This could lead to unauthorized changes to lead generation forms or impact the site's ability to collect customer data.

Vendors: [Thrive Themes](https://junglewise.ai/threats/vendors/thrive-themes).

## Quick answers

**Is CVE-2026-65435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65435 being exploited in the wild.

**How severe is CVE-2026-65435?** Medium severity, with a CVSS score of 6.5, published 27 July 2026.

**Which products and versions are affected?** Thrive Themes Thrive Leads <= 10.9.2.

**Is there a fix for CVE-2026-65435?** A patch was published on 2026-07-27: Patch released in version 10.9.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65435 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65435?** Check whether you run Thrive Themes Thrive Leads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Thrive Leads plugin for WordPress suffers from a broken access control vulnerability (CWE-862) due to missing authorization checks in certain functions. An unauthenticated remote attacker can exploit this flaw to execute actions that should be restricted to higher-privileged users. The vulnerability has a CVSS score of 6.5, indicating a moderate impact on integrity and availability. The issue is resolved in version 10.9.2.1.

## Affected products

- Thrive Themes Thrive Leads <= 10.9.2

## Timeline

- 2026-06-18: disclosed: Reported by Dave Jong (Patchstack)
- 2026-07-27: advisory: NVD and Patchstack advisory published
- 2026-07-27: patched: Patch released in version 10.9.2.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/thrive-leads/vulnerability/wordpress-thrive-leads-version-plugin-10-9-2-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/thrive-leads/vulnerability/wordpress-thrive-leads-version-plugin-10-9-2-broken-access-control-vulnerability?_s_id=cve)