The vulnerability CVE-2026-22426 affects the Sweet Jane plugin by Elated-Themes, allowing an authorization bypass through a user-controlled key due to misconfigured access control. This flaw enables users with limited privileges to escalate their access or perform actions beyond their authorization scope. The affected versions include all versions up to and including 1.2. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Successful exploitation could allow an attacker with low privileges to bypass authorization controls, potentially leading to limited integrity and availability impacts within the affected application. There is no indication of confidentiality compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor for vendor updates and apply patches once released. Until then, consider restricting access to trusted users and reviewing access control configurations to mitigate risk.