What is GHSA-hfr5-224q-hqxr?

GHSA-hfr5-224q-hqxr is a security advisory published by GitHub Security Advisories with High severity. The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX...

Which CVE IDs does GHSA-hfr5-224q-hqxr cover?

GHSA-hfr5-224q-hqxr covers the following CVE IDs: CVE-2026-88797. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hfr5-224q-hqxr?

GHSA-hfr5-224q-hqxr has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-hfr5-224q-hqxrHighCVSS 7.1

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-88797 →

📋 Description

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88797
https://wpscan.com/vulnerability/250a7d7c-9c9b-4619-a6f4-533d29a30e23
https://github.com/advisories/GHSA-hfr5-224q-hqxr