CVE-2026-78477: Jawn WordPress Theme Privilege Escalation

CVE-2026-78477 Overview

The Jawn theme for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 1.4.2. Unauthenticated attackers can exploit this flaw to elevate their privileges to administrator level over the network. The weakness is categorized as an improper privilege management issue ([CWE-266]).

Successful exploitation grants full control of the affected WordPress site, including content, users, and plugins. Because no authentication or user interaction is required, exposed sites face immediate risk once a working exploit is published.

Critical Impact
Unauthenticated remote attackers can gain administrator access to WordPress sites running the Jawn theme, leading to full site takeover.

Affected Products

Jawn theme for WordPress — all versions through 1.4.2
WordPress sites with the Jawn theme active or installed
Hosting environments serving vulnerable Jawn theme deployments

Discovery Timeline

2026-08-25 - CVE-2026-78477 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78477

Vulnerability Analysis

The Jawn theme exposes functionality that allows an unauthenticated request to change a user's role or create a new privileged account. The flaw is a privilege management defect classified under [CWE-266] (Incorrect Privilege Assignment). No credentials, tokens, or user interaction are required to trigger the escalation path.

Because the attack vector is the network and the impact spans confidentiality, integrity, and availability, an attacker who reaches the site over HTTP or HTTPS can obtain administrator control. Once administrative privileges are acquired, the attacker can install malicious plugins, modify theme files, exfiltrate data, or pivot to the underlying host through PHP execution.

Root Cause

The root cause is a missing or insufficient authorization check on a theme endpoint that modifies user privileges. The affected code path does not validate the requester's capability (for example, current_user_can()) or verify a nonce before performing a privileged action. This allows anonymous callers to invoke a function that should be limited to administrators.

Attack Vector

Exploitation occurs remotely through crafted HTTP requests to the vulnerable theme endpoint. The attacker sends a request that triggers the privileged action, resulting in either the creation of a new administrator account or the elevation of an existing account. Technical specifics are documented by the third-party advisories referenced below.

Refer to the Patchstack Vulnerability Report and Wordfence Vulnerability Intel entries for additional detail.

Detection Methods for CVE-2026-78477

Indicators of Compromise

Unexpected WordPress accounts with the administrator role, particularly accounts created without a corresponding audit trail.
Recent modifications to user metadata in wp_usermeta that change wp_capabilities to administrator.
HTTP POST requests to Jawn theme PHP endpoints originating from unauthenticated sessions.
New or modified plugin files, mu-plugins, or theme files following anomalous administrator activity.

Detection Strategies

Inventory WordPress installations and flag any site running the Jawn theme at version 1.4.2 or earlier.
Correlate web server access logs with WordPress user-creation and role-change events to spot unauthenticated privilege changes.
Alert on administrator logins from new IP addresses, user agents, or geolocations shortly after requests to Jawn theme paths.

Monitoring Recommendations

Enable WordPress audit logging for user creation, role changes, and options updates.
Ingest web server and application logs into a SIEM and retain them long enough to investigate delayed exploitation.
Monitor filesystem integrity for wp-content/themes/jawn/ and the broader wp-content/ directory.

How to Mitigate CVE-2026-78477

Immediate Actions Required

Deactivate the Jawn theme on all affected WordPress sites until a fixed version is confirmed.
Audit all users with the administrator role and remove any account that cannot be attributed to a legitimate operator.
Rotate credentials, application passwords, and API keys tied to the affected sites.
Restrict access to wp-admin/ and theme endpoints using an allowlist or web application firewall rules.

Patch Information

No vendor-issued fixed version is listed in the referenced advisories at the time of publication. Consult the Patchstack Vulnerability Report and Wordfence Vulnerability Intel entries for the current patch status and apply an updated theme release as soon as it becomes available.

Workarounds

Switch to a different, actively maintained WordPress theme until Jawn issues a security update.
Deploy a WAF ruleset that blocks unauthenticated POST requests to Jawn theme PHP files.
Enforce IP allowlisting for /wp-admin/ and /wp-login.php to limit exposure of privileged endpoints.
Require multi-factor authentication for all administrator accounts to raise the cost of account takeover.

bash

# Example: temporarily block unauthenticated access to the Jawn theme directory in nginx
location ~* /wp-content/themes/jawn/.*\.php$ {
    deny all;
    return 403;
}