CVE-2026-78477 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The Jawn WordPress theme (versions ≤ 1.4.2) contains a remote, unauthenticated privilege‑escalation flaw (CVE‑2026‑78477) that grants attacker administrator rights. All WordPress sites deploying this theme are exposed to full site takeover, potentially compromising customer data and business continuity. Immediate decision is required to approve emergency patch deployment or temporary theme removal across all production environments.

Verified Facts

• The Jawn theme for WordPress is vulnerable to privilege escalation in all versions up to and including 1.4.2 — NVD record.
• The vulnerability allows unauthenticated attackers to obtain administrator privileges — NVD record.
• CVSS base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — NVD record.

Threat Classification

Threat type: Remote unauthenticated privilege‑escalation vulnerability (HIGH CONFIDENCE). Affected sectors: any organization running WordPress sites that have installed the Jawn theme, including media, e‑commerce, education, and public‑sector portals (MEDIUM CONFIDENCE). Geographic scope: Global, as WordPress installations are worldwide (HIGH CONFIDENCE). Exploitation status: No public evidence of active exploitation; only proof‑of‑concept exists (MEDIUM CONFIDENCE). Attacker motivation: Full control of the compromised web application to exfiltrate data, deface content, or install persistent web shells (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: Remote network access, no authentication required, low complexity (HIGH CONFIDENCE).
• Impact scope: Full administrator control leads to confidentiality, integrity, and availability compromise (HIGH CONFIDENCE).
• Prevalence: Jawn theme is widely distributed via the official WordPress theme repository (MEDIUM CONFIDENCE).
• CVSS score: 9.8 (Critical) (HIGH CONFIDENCE).

Business Impact

• Operational disruption: An attacker with admin rights can inject malicious code, redirect traffic, or shut down the site, causing immediate revenue loss and service outage.
• Regulatory liability: If personal data is exfiltrated, GDPR fines may reach €20 million or 4 % of annual turnover; NIS2 penalties can exceed €10 million for critical services.
• Financial exposure: Emergency incident response, forensic investigation, and potential legal settlements can exceed $250 k per affected site (based on industry averages).
• Reputational damage: Public disclosure of a compromised WordPress site erodes customer trust and can trigger churn of up to 5 % of the user base within 30 days.

Technical Analysis

• Attack vector: Network‑level HTTP request to vulnerable Jawn theme files (AV:N).
• Exploitation chain: Crafted request bypasses insecure privilege checks → execution of privileged WordPress function → creation of admin‑level user or session hijack (AC:L, PR:N, UI:N).
• Affected component: Jawn theme PHP files responsible for role validation (versions ≤ 1.4.2).
• Root cause: Improper access control (CWE‑266) allowing privilege escalation without authentication.
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE Analysis

• CVE‑2026‑78477 — WordPress Jawn theme ≤ 1.4.2 — CWE‑266 (Improper Access Control) — Network (Remote) — No authentication required — No official patch released as of article date.

MITRE ATT&CK Mapping

• Privilege Escalation → T1068: Exploitation for Privilege Escalation — attacker exploits insecure role check in the Jawn theme to obtain admin rights.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• HTTP requests targeting /wp-content/themes/jawn/ with unusual query parameters.
• POST requests to /wp-admin/admin-ajax.php invoking actions not present in default WordPress core.
• Creation of new WordPress users with the role “administrator” within a short time window.
• Modification of the wp_options table entries related to user capabilities.

Detection Engineering Guidance

• Web server access logs: monitor for 200/302 responses to /wp-content/themes/jawn/ URIs containing suspicious payloads; flag if request length > 1 KB.
• WordPress authentication logs (if plugin enabled): alert on creation of users with role=administrator where the creator IP is external and not previously seen.
• MySQL general log or audit plugin: detect INSERT statements into wp_users with user_level ≥ 10 originating from non‑admin IPs.
• File integrity monitoring (OSSEC, Tripwire): generate alerts on new PHP files added to /wp-content/uploads/ after a privilege‑escalation event.
• Endpoint detection (Sysmon Event ID 1): flag execution of php.exe processes launched by the web server service with command line arguments referencing Jawn theme files.

Sigma Rules

title: WordPress Jawn Theme Privilege Escalation - New Administrator Account
id: 3f9c2a1e-5b4d-4a6f-9e2c-1d7f8b6c9a3e
status: stable
description: Detect creation of a new WordPress user with the administrator role, indicative of exploitation of CVE‑2026‑78477.
logsource:
    product: mysql
    service: mysql
detection:
    selection:
        query: '*INSERT*INTO*wp_users*'
        user_role: '*administrator*'
    condition: selection
falsepositives:
    - Legitimate bulk user import
level: high
tags:
    - attack.t1068

Threat Hunting Queries

• Hypothesis: Unauthenticated attacker sent crafted HTTP request to Jawn theme files — Source: Web server access logs; query for status 200 on /wp-content/themes/jawn/* with query string length > 500.
• Hypothesis: New admin accounts were created without prior admin session — Source: MySQL audit logs; query for INSERT into wp_users where user_level ≥ 10 and source IP not in admin IP whitelist.
• Hypothesis: Privilege escalation triggered modification of capability options — Source: WordPress option change logs; query for updates to wp_capabilities meta_key.
• Hypothesis: Malicious PHP webshell deployed post‑escalation — Source: File integrity monitoring; query for new *.php files in /wp-content/uploads/ after admin creation event.
• Hypothesis: Remote code execution via admin‑ajax endpoint — Source: Web application firewall logs; query for POST to /wp-admin/admin-ajax.php with unknown action parameters.

SOC Analyst Playbook

• P0 – Verify exploitation: Query web server logs for recent Jawn theme requests; if found, isolate the affected host and block the source IP (firewall ACL).
• P0 – Account audit: Pull WordPress user table; if new administrator accounts exist, disable them and reset all admin passwords (WP‑CLI).
• P1 – Artifact collection: Capture web server request payloads, MySQL binary logs, and file system snapshots for forensic analysis.
• P1 – Patch verification: Check vendor site for any released patch; if unavailable, apply temporary mitigation by removing the Jawn theme directory.
• P2 – Notification: Escalate to Incident Response Lead and draft internal breach notification if data exfiltration is suspected.

Executive Decision Matrix

🔗 Related Intelligence Reports

• Related topic: CVE-2026-56705 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-56710 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78676 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78683 — CVSS 9.6 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-71914 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record