CVE-2026-27364: Style Kits Auth Bypass Vulnerability

CVE-2026-27364 Overview

CVE-2026-27364 is a broken access control vulnerability in the Style Kits WordPress plugin (also distributed as analogwp-templates) in versions up to and including 2.6.5. The flaw allows authenticated users with Subscriber-level privileges to invoke restricted plugin functionality due to missing authorization checks [CWE-862]. Successful exploitation lets low-privileged accounts modify integrity-sensitive plugin state without administrative approval. The issue is reachable over the network and requires only a valid Subscriber account, which WordPress sites commonly allow through open registration.

Critical Impact
Authenticated Subscriber accounts can perform actions restricted to higher-privileged roles, undermining site integrity on WordPress installations running Style Kits 2.6.5 or earlier.

Affected Products

Style Kits WordPress plugin (analogwp-templates) versions ≤ 2.6.5
WordPress sites with Subscriber-level registration enabled
Any site bundling vulnerable versions of the Style Kits plugin

Discovery Timeline

2026-08-24 - CVE-2026-27364 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-27364

Vulnerability Analysis

The Style Kits plugin exposes plugin actions without verifying the caller's role or capability. WordPress relies on functions such as current_user_can() and nonce checks to gate privileged handlers. In the affected versions, one or more handlers omit these checks, so any authenticated session is treated as authorized. This is a classic Broken Access Control weakness [CWE-862] rather than an authentication bypass, since a valid login is still required.

The impact is scoped to integrity. The CVSS vector indicates no confidentiality or availability impact, meaning the flaw is used to alter plugin-managed configuration or content rather than read secrets or take the site offline. On multi-author or membership-driven WordPress installations, Subscriber accounts are inexpensive to obtain, which lowers the practical bar to exploitation.

Root Cause

The root cause is missing authorization on plugin endpoints. The vulnerable code paths execute privileged logic without confirming that the requesting user holds the required WordPress capability. Refer to the Patchstack Vulnerability Report for the specific handlers.

Attack Vector

An attacker registers or obtains a Subscriber-level WordPress account on a target site. Using that session, the attacker sends authenticated HTTP requests directly to the vulnerable Style Kits handlers, typically through the WordPress AJAX or REST interface. The plugin executes the requested action because it does not verify the caller's role.

The vulnerability manifests where privileged plugin actions are registered without an accompanying capability check. See the linked advisory for handler-level technical details.

Detection Methods for CVE-2026-27364

Indicators of Compromise

Unexpected changes to Style Kits settings, global styles, or template records not attributable to administrator activity.
Authenticated admin-ajax.php or REST API requests to Style Kits endpoints originating from Subscriber-role accounts.
Newly registered Subscriber accounts followed shortly by plugin-modifying requests.

Detection Strategies

Inspect web server access logs for POST requests to Style Kits action endpoints where the associated WordPress session cookie maps to a non-administrative user.
Compare the plugin version reported by the site against the fixed release; installations at 2.6.5 or earlier are in scope.
Correlate WordPress audit logs of setting changes against the acting user's role to surface privilege mismatches.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record role, capability checks, and configuration changes.
Alert on Subscriber accounts that invoke plugin AJAX actions outside of expected front-end interactions.
Track anomalous spikes in Subscriber account registration on sites with open registration.

How to Mitigate CVE-2026-27364

Immediate Actions Required

Update the Style Kits plugin to a version later than 2.6.5 as soon as the vendor-supplied fix is available.
Audit existing Subscriber accounts and remove those that are not required.
Disable open user registration (Settings → General → Anyone can register) if it is not a business requirement.

Patch Information

Apply the fixed release referenced in the Patchstack Vulnerability Report. Until the site is upgraded past 2.6.5, treat every Subscriber session as capable of invoking privileged plugin actions.

Workarounds

Temporarily deactivate the Style Kits plugin on production sites that cannot be patched immediately.
Restrict access to wp-admin/admin-ajax.php and the REST API for non-administrative roles using a web application firewall rule.
Enforce strong role hygiene by demoting or removing unused Subscriber and Contributor accounts.

bash

# Configuration example
# Disable open registration via WP-CLI
wp option update users_can_register 0

# Confirm installed Style Kits version
wp plugin get analogwp-templates --field=version

# Deactivate the plugin until a fixed version is installed
wp plugin deactivate analogwp-templates