CVE-2026-27364: CWE-862 Missing Authorization in AnalogWP Style Kits

CVE-2026-27364 is a broken access control vulnerability (CWE-862) affecting AnalogWP Style Kits versions up to 2.6.5. The flaw allows subscriber-level users to bypass authorization restrictions, leading to unauthorized modification or manipulation of style kits. The CVSS 3.1 score is 6.5 (medium), with the vector indicating network attack vector, low attack complexity, privileges required at the subscriber level, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

The vulnerability allows unauthorized modification of style kits by subscriber-level users, potentially compromising the integrity of the affected system. There is no impact on confidentiality or availability. Exploitation requires network access and subscriber privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict subscriber privileges where possible and monitor for suspicious activity related to style kit modifications.