{"id":"CVE-2026-42706","published":"2026-10-10T20:16:36.040","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Broken Access Control in DK <= 3.2.1 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/dk/vulnerability/wordpress-dk-theme-3-2-1-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes a broken access control vulnerability in DK versions 3.2.1 and earlier that allows unauthenticated users to perform actions they shouldn't be able to, potentially leading to unauthorized data modification or system compromise. The flaw stems from insufficient authentication checks on specific API endpoints.","exploitability":"Exploitation is likely straightforward with no special preconditions required, as the vulnerability affects unauthenticated access to protected functionality.","blast_radius":"The impact could be significant if exploited, potentially allowing attackers to modify or delete data through exposed API endpoints without needing any authentication credentials.","remediation":"Upgrade to DK version 3.2.2 or later to remediate this broken access control vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","unauthenticated","api","broken-access"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:08.279Z"}}