CVE-2026-103072: Missing Authorization in VillaTheme VillaTheme Core

The vulnerability identified as CVE-2026-103072 affects VillaTheme Core versions from initial releases up to 1.0.5. It is caused by missing authorization checks, which result in incorrect access control configurations. This flaw could allow an attacker with limited privileges to access or perform actions beyond their authorization level. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires privileges, no user interaction, unchanged scope, low confidentiality impact, and no integrity or availability impact.

An attacker with some level of privileges could exploit this vulnerability to gain unauthorized access to certain features or data within VillaTheme Core. The confidentiality impact is low, and there is no impact on integrity or availability. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations in VillaTheme Core to prevent unauthorized access.