VW Wedding <= 1.3.7 - Missing Authorization

2026-07-02 00:00

Nabil Irawan

Strategic Overview

Status

Unpatched

Affected ThemeVW Wedding

Affected Version<= 1.3.7

CVSS5.3Medium

CVECVE-2026-57776

View all VW Wedding vulnerabilities

Vulnerability Overview

The VW Wedding theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Technical Analysis

REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

External References

https://www.cve.org/CVERecord?id=CVE-2026-57776 https://www.wordfence.com/threat-intel/vulnerabilities/id/c7479f03-3677-4192-9978-a3653d37fcb6

VW Wedding <= 1.3.7 - Missing Authorization (CVE-2026-57776)