Executive brief
The Gillion theme for WordPress contains a security flaw that allows unauthorized individuals to perform actions that should be restricted to administrators. This issue stems from a failure to properly verify user permissions before executing certain functions. While the impact is considered low, it could allow an attacker to modify site settings or content without needing a password. Owners of sites using this theme should update to version 4.14 or later to secure their installations.
Technical details
A broken access control vulnerability exists in the Shufflehound Gillion theme for WordPress (versions up to and including 4.13). The flaw is rooted in a missing authorization check (CWE-862) within the theme's functional code, which fails to validate the identity or permission level of a user before executing specific operations. A remote, unauthenticated attacker can exploit this by sending crafted network requests to the vulnerable site. Successful exploitation allows the attacker to perform actions with higher privileges, though the CVSS vector suggests the impact is limited to data integrity (I:L) rather than full system compromise or data theft. The issue is resolved in version 4.14.
Affected products
- Shufflehound Gillion <= 4.13
Timeline
- 2026-01-31: disclosed: Reported by Phat RiO via Patchstack
- 2026-07-27: advisory: NVD and Patchstack published advisory details
- 2026-07-27: patched: Version 4.14 released to address the vulnerability