CVE-2026-73997: Kadence WP Starter Templates DoS Flaw

CVE-2026-73997 Overview

CVE-2026-73997 is an unauthenticated denial of service vulnerability affecting the Starter Templates by Kadence WP WordPress plugin in versions up to and including 2.3.3. The flaw stems from missing resource consumption controls [CWE-770], allowing remote attackers to exhaust server resources without authentication or user interaction. Successful exploitation renders the WordPress site unavailable to legitimate users. The vulnerability carries a network-based attack vector with low complexity and no privileges required.

Critical Impact
Remote unauthenticated attackers can trigger denial of service conditions against WordPress sites running vulnerable versions of the Kadence Starter Templates plugin, causing complete availability loss.

Affected Products

Starter Templates by Kadence WP plugin for WordPress
Versions <= 2.3.3
All WordPress installations using the affected plugin versions

Discovery Timeline

2026-08-18 - CVE-2026-73997 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73997

Vulnerability Analysis

The vulnerability resides in the Starter Templates by Kadence WP plugin, a widely used WordPress plugin for importing pre-built site templates. Remote attackers can send crafted requests to plugin endpoints without authentication, triggering excessive resource consumption on the target server.

The flaw maps to CWE-770 (Allocation of Resources Without Limits or Throttling). The plugin fails to enforce upper bounds on resource-intensive operations, allowing attackers to submit repeated or oversized requests that consume CPU, memory, or I/O until the underlying WordPress instance becomes unresponsive.

Root Cause

The root cause is the absence of rate limiting, request size validation, or resource quotas on unauthenticated plugin endpoints. When a request initiates an expensive operation such as template parsing, import processing, or file handling, the plugin does not restrict concurrent execution or bound the amount of work performed per request.

Attack Vector

Attackers exploit this vulnerability over the network by sending unauthenticated HTTP requests directly to vulnerable plugin endpoints exposed by WordPress. No user interaction, authentication, or elevated privileges are required. Repeated requests amplify resource consumption until the web server or PHP worker pool becomes saturated, denying service to legitimate visitors.

Detailed technical analysis is available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-73997

Indicators of Compromise

Sudden spikes in CPU or memory usage on WordPress hosts running the Kadence Starter Templates plugin
High volumes of unauthenticated HTTP requests targeting plugin-specific endpoints under /wp-admin/admin-ajax.php or REST API routes registered by the plugin
Exhausted PHP-FPM worker pools and elevated 5xx response rates from the web server
Repeated requests from single or distributed source IPs to Kadence plugin URLs

Detection Strategies

Monitor WordPress access logs for repeated requests to Kadence Starter Templates endpoints from unauthenticated sources
Correlate web server error logs with resource utilization metrics to identify DoS patterns
Deploy web application firewall (WAF) rules that flag anomalous request rates against WordPress plugin endpoints

Monitoring Recommendations

Track request rates per source IP against known plugin routes and alert on threshold violations
Baseline normal CPU, memory, and PHP worker utilization for WordPress hosts and alert on sustained deviations
Enable verbose logging on the reverse proxy or WAF layer to capture request payloads targeting the plugin

How to Mitigate CVE-2026-73997

Immediate Actions Required

Update the Starter Templates by Kadence WP plugin to a version newer than 2.3.3 as soon as a patched release is available
Restrict access to plugin endpoints via WAF rules or IP allowlisting until patches are applied
Apply rate limiting at the reverse proxy or WAF layer to unauthenticated WordPress endpoints

Patch Information

Refer to the Patchstack Vulnerability Report for the latest patch status and remediation guidance from the plugin vendor.

Workarounds

Temporarily deactivate the Starter Templates by Kadence WP plugin on production sites if template import functionality is not required
Deploy WAF rules to block or throttle unauthenticated requests to plugin-specific REST and AJAX routes
Restrict administrative endpoints to trusted source IP ranges via .htaccess or reverse proxy configuration

bash

# Example nginx rate limiting for WordPress plugin endpoints
limit_req_zone $binary_remote_addr zone=kadence_limit:10m rate=5r/s;

location ~ ^/wp-admin/admin-ajax\.php$ {
    limit_req zone=kadence_limit burst=10 nodelay;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}