CVE-2026-24615: Cream Magazine Auth Bypass Vulnerability

CVE-2026-24615 Overview

CVE-2026-24615 is a Missing Authorization vulnerability [CWE-862] affecting the themebeez Cream Magazine WordPress theme. The flaw exists in versions up to and including 2.1.10 and results from incorrectly configured access control security levels. Unauthenticated attackers can reach functionality that should be restricted to authorized users. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction. Successful exploitation produces a limited integrity impact on affected WordPress sites running the theme.

Critical Impact
Unauthenticated attackers can exploit broken access control in Cream Magazine <=2.1.10 to interact with protected theme functionality over the network without authentication or user interaction.

Affected Products

themebeez Cream Magazine WordPress theme
Cream Magazine versions from n/a through 2.1.10
WordPress sites using the cream-magazine theme

Discovery Timeline

2026-01-23 - CVE-2026-24615 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-24615

Vulnerability Analysis

The Cream Magazine theme exposes one or more code paths that fail to verify whether the requesting user holds the privileges required to execute the action. This is a classic Missing Authorization weakness [CWE-862]: authentication state and capability checks (such as current_user_can() or nonce validation) are either absent or incorrectly applied before sensitive operations execute.

Because the attack vector is network-based and no authentication is needed, any remote attacker who can reach the WordPress site can issue requests that should be gated. The impact is limited to integrity, meaning attackers can modify some data or state but cannot read confidential information or directly take the site offline through this flaw alone. The Exploit Prediction Scoring System currently ranks the likelihood of observed exploitation in the lower range of the WordPress theme vulnerability population.

Root Cause

The root cause is incorrectly configured access control on theme endpoints or handlers. WordPress themes commonly register AJAX actions, REST routes, or admin-post handlers that must explicitly verify user capabilities and request nonces. In Cream Magazine <=2.1.10, at least one such handler omits or improperly implements these checks, allowing unauthenticated callers to reach privileged logic.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable theme endpoint on a target WordPress installation. No session, cookie, or token is required. The request triggers the protected action because the server-side authorization gate is missing. Exploitation can be automated against any internet-reachable site running a vulnerable version of the theme.

No public proof-of-concept code is referenced in the advisory. For technical specifics, refer to the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2026-24615

Indicators of Compromise

Unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php or theme-specific REST routes referencing cream-magazine actions.
Unexpected modifications to theme options, widget configuration, or post metadata without a corresponding administrator login event.
Web server access logs showing high-frequency requests to theme endpoints from a single IP or distributed scanning infrastructure.

Detection Strategies

Inventory WordPress installations and flag any site running the cream-magazine theme at version 2.1.10 or earlier.
Inspect web access logs for requests targeting theme AJAX actions that lack an authenticated session cookie (wordpress_logged_in_*).
Correlate WordPress audit logs with HTTP request logs to identify state changes that were not preceded by an administrator authentication.

Monitoring Recommendations

Enable WordPress activity logging to capture option changes, role assignments, and content modifications with their originating user identity.
Forward web server and WordPress logs to a centralized analytics platform and alert on anonymous writes to theme-controlled resources.
Monitor outbound requests from the web host that follow suspicious theme endpoint hits, which can indicate post-exploitation activity.

How to Mitigate CVE-2026-24615

Immediate Actions Required

Identify all WordPress sites running Cream Magazine and confirm the installed theme version.
Restrict access to /wp-admin/admin-ajax.php and theme REST routes from untrusted networks where feasible.
Apply a Web Application Firewall (WAF) virtual patch rule that blocks unauthenticated calls to vulnerable Cream Magazine handlers until the theme is updated.

Patch Information

At the time of NVD publication, the advisory lists affected versions as n/a through <=2.1.10. Site operators should consult the Patchstack WordPress Vulnerability advisory for the latest fixed release information from themebeez and upgrade to a patched version once available.

Workarounds

Temporarily switch to an alternative theme if a patched Cream Magazine release is not yet available.
Deploy WAF rules that require authentication cookies for requests invoking cream-magazine AJAX or REST actions.
Limit administrative endpoints to known IP ranges using web server access control directives.

bash

# Example nginx restriction limiting admin-ajax to authenticated sessions
location = /wp-admin/admin-ajax.php {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}