Is CVE-2026-65500 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65500 being exploited in the wild.

How severe is CVE-2026-65500?

High severity, with a CVSS score of 7.5, published 23 July 2026.

Is there a fix for CVE-2026-65500?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65500 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-65500?

Check whether you run Pixelace Manual at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65500: pixelacehq Manual Theme broken access control

CVE-2026-65500 · Severity: high · CVSS 7.5 · Published 2026-07-23

A security vulnerability exists in the Manual WordPress theme, which is used to build documentation and knowledge base websites. An unauthorized person could bypass security restrictions to access sensitive information that should be protected. This could lead to the exposure of private documentation or internal company data stored within the knowledge base.

Technologies: Pixelace Manual. Vendors: Pixelace.

Quick answers

Is CVE-2026-65500 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65500 being exploited in the wild.
How severe is CVE-2026-65500?: High severity, with a CVSS score of 7.5, published 23 July 2026.
Which products and versions are affected?: Pixelace Manual <= 7.5.4.
Is there a fix for CVE-2026-65500?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65500 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-65500?: Check whether you run Pixelace Manual at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Access Control vulnerability (CWE-862: Missing Authorization) exists in the Manual - Documentation, Knowledge Base & Education WordPress Theme through version 7.5.4. The flaw allows an unauthenticated remote attacker to bypass authorization checks due to missing validation in theme functions. According to the CVSS vector, this results in a high impact on confidentiality (C/H) but no impact on integrity or availability. As of the advisory date, no official patch has been released by the developer, and the vulnerability is considered difficult to mitigate via standard virtual patching.

Affected products

pixelacehq Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4

Timeline

2026-06-22: disclosed: Reported by researcher ed32.dll
2026-07-23: advisory: Published by Patchstack and NVD

References

https://patchstack.com/database/wordpress/theme/manual/vulnerability/wordpress-manual-documentation-knowledge-base-education-wordpress-theme-theme-7-5-4-broken-access-control-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.