CVE-2026-12471 describes a missing authorization vulnerability (CWE-862) in the Spexo theme for WordPress by templatescoderthemes. Specifically, the activate_plugin function lacks a capability check, enabling authenticated users with low-level privileges (Subscriber and above) to activate a limited set of plugins. This issue affects all versions up to and including 2.0.11. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No official patch or remediation guidance is currently documented.

Authenticated users with Subscriber-level privileges or higher can activate certain plugins without proper authorization. This could lead to limited unauthorized changes in the WordPress environment, potentially affecting site integrity. There is no impact on confidentiality or availability reported. No known exploits are currently documented in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access and higher to trusted users only. Monitor for updates from templatescoderthemes regarding a security patch addressing this missing authorization issue.