AJAX Action Vulnerability in Vayu X WordPress Theme Affects User Authentication
CVE-2026-88797
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88797?
The Vayu X WordPress theme prior to version 1.0.6 contains a critical vulnerability that fails to verify user capabilities on a specific AJAX action. This oversight grants authenticated users, including roles with limited permissions like subscribers, the ability to bypass nonce protections. As a result, these users can install and activate any plugin available within the WordPress.org repository, potentially compromising the security and integrity of the site.
Affected Version(s)
Vayu X 0 < 1.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.