CVE-2023-26540

CVE-2023-26540 is a critical Improper Privilege Management vulnerability in the Favethemes Houzez WordPress theme, affecting versions up to and including 2.7.1. This flaw allows unauthenticated attackers to achieve privilege escalation, leading to complete compromise of affected websites. With a CVSS score of 9.8 (CRITICAL), it poses a significant risk due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. While no public exploit code is available on common platforms like Metasploit or ExploitDB, media coverage from BleepingComputer and SecurityWeek confirms active exploitation in the wild, indicating a high level of community and attacker interest.