CVE-2026-22343: WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerability

Synopsis

A broken access control vulnerability affects the WordPress Dating Theme plugin by PremiumPress Limited, versions 11.2.0 and below. The flaw is reachable over the network without any authentication, meaning any remote visitor can trigger the affected functionality. Successful exploitation gives an attacker read access to sensitive data and limited ability to modify or disrupt the affected site. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no prior foothold on the host is required.

• AuthenticationNot required

  No account or session token is needed; the vulnerable functionality is accessible to any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors must align for the attack to succeed.

Blast Radius

• An attacker reads sensitive site data, which may include user profile information, private messages, or stored credentials held in the dating platform.
• An attacker makes limited modifications to persisted site content or configuration rows within the application.
• An attacker causes limited disruption to site availability, degrading the experience for users of the dating platform.
• Because no authentication barrier exists, exploitation can be scripted and run at scale against any publicly accessible instance of the theme.