CVE-2026-32341: Benevolent Theme Auth Bypass Vulnerability

CVE-2026-32341 Overview

CVE-2026-32341 is a Missing Authorization vulnerability [CWE-862] affecting the raratheme Benevolent WordPress theme. The flaw impacts all versions of the theme up to and including 1.3.9. Attackers can exploit incorrectly configured access control security levels to interact with functionality that should require elevated privileges. The vulnerability is network-exploitable, requires no authentication, and needs no user interaction. Successful exploitation results in limited integrity impact on the affected WordPress site.

Critical Impact

Unauthenticated attackers can abuse improperly protected theme functionality to modify limited site data without holding the appropriate permissions.

Affected Products

• raratheme Benevolent WordPress theme versions up to and including 1.3.9
• WordPress sites running the vulnerable Benevolent theme
• Any deployment that has not updated to a patched release above 1.3.9

Discovery Timeline

• 2026-03-13 - CVE-2026-32341 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-32341

Vulnerability Analysis

The Benevolent theme exposes one or more actions that lack proper capability or permission checks. The issue maps to [CWE-862] Missing Authorization, where the application does not verify that a requester is authorized to invoke a function before executing it. Because the attack vector is network-based and requires no privileges or user interaction, an external attacker can issue crafted HTTP requests directly against the WordPress site.

The theme exposes endpoints, likely registered through WordPress admin-ajax.php or REST routes, that should validate the caller using functions such as current_user_can() or capability-aware nonces. The missing checks let unauthorized callers invoke handlers that were intended for administrators or other elevated roles. The resulting impact is limited to integrity, meaning attackers can alter specific data but cannot directly read confidential information or take the site offline through this flaw alone.

Root Cause

The root cause is incorrect access control configuration within the theme's request handlers. Privileged actions are reachable without authenticated context or capability validation. WordPress themes that register AJAX or REST endpoints must enforce both authentication and capability checks; Benevolent fails to do so on at least one privileged action through version 1.3.9.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the vulnerable endpoint on a site running the Benevolent theme. Because the handler does not enforce authorization, the server processes the request as if it came from an authorized user. Refer to the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2026-32341

Indicators of Compromise

• Unexpected POST requests to wp-admin/admin-ajax.php or theme-specific REST routes originating from unauthenticated sessions.
• Modifications to theme options, settings, or content with no corresponding administrator login event in the audit log.
• HTTP 200 responses to privileged action calls without a valid wordpress_logged_in_* cookie present.

Detection Strategies

• Inventory WordPress installations to identify any using the Benevolent theme at version 1.3.9 or earlier.
• Review web server access logs for anomalous calls to theme handlers, focusing on requests lacking authentication cookies.
• Correlate WordPress option changes against authenticated administrator activity to surface unauthorized modifications.

Monitoring Recommendations

• Enable verbose WordPress audit logging for option updates, user changes, and theme-level actions.
• Forward web server and WordPress logs to a centralized SIEM for correlation and alerting on unauthenticated administrative actions.
• Alert on bursts of admin-ajax.php traffic with privileged action parameters from unauthenticated clients.

How to Mitigate CVE-2026-32341

Immediate Actions Required

• Update the Benevolent theme to a release above 1.3.9 as soon as a patched version is available from raratheme.
• Audit the affected WordPress sites for unauthorized changes to theme settings, content, and user accounts.
• Restrict administrative endpoints behind a Web Application Firewall (WAF) with rules targeting the vulnerable action parameters.

Patch Information

No fixed version is listed in the NVD entry at publication. Site operators should monitor raratheme's release notes and the Patchstack Vulnerability Report for an updated theme version that enforces proper authorization on the affected endpoints.

Workarounds

• Deploy WAF rules to block unauthenticated requests to known theme AJAX or REST handlers until a patch is installed.
• Replace the Benevolent theme with an actively maintained alternative if a fixed release is not yet available.
• Limit access to wp-admin/admin-ajax.php from untrusted networks where business requirements allow.

# Example WAF rule (ModSecurity) blocking unauthenticated theme AJAX calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:1,deny,status:403,id:1032341,msg:'Block unauthenticated Benevolent theme action'"
  SecRule ARGS:action "@rx ^(benevolent_|raratheme_)" "chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"