CVE-2026-40730

CVE-2026-40730 is a Missing Authorization vulnerability affecting the ThemeGrill Demo Importer WordPress plugin up to version 2.0.0.6, which allows attackers to bypass access control mechanisms through incorrectly configured security levels. This vulnerability enables unauthorized users to perform actions that should be restricted to authenticated administrators or specific user roles. The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction, making it relatively easy to exploit remotely. The primary impact is confidentiality loss through unauthorized information disclosure, though integrity and availability are not affected. The FAUCET Risk Score of 32.0 out of 100 suggests moderate overall risk when considering various contextual factors. Currently, there is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The extremely low EPSS score of 0.00037 indicates minimal probability of exploitation attempts within the next 30 days relative to other vulnerabilities. Organizations running affected versions should prioritize patching as a routine security measure rather than as an emergency response.