A privilege escalation flaw in the MVPThemes Jawn theme for WordPress lets unauthenticated attackers elevate themselves to administrator, scoring a CVSS 9.8 CRITICAL.
What Is It
CVE-2026-78477 is a privilege escalation vulnerability (CWE-266, Incorrect Privilege Assignment) in the Jawn WordPress theme published by MVPThemes. According to the advisory, the theme is vulnerable in all versions up to and including 1.4.2, and the flaw "makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator."
The CVE was published on 2026-08-25 with Wordfence ([email protected]) as the assigning source. NVD currently lists the record status as "Received."
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability factor is at its worst: network attack vector, low attack complexity, no privileges required, and no user interaction. The exploitability subscore is 3.9, the maximum, and the impact subscore is 5.9, with high confidentiality, integrity, and availability impact.
In practical terms, that combination means an attacker needs nothing more than network reach to the site. Administrator access on a WordPress installation is effectively full control of the site.
There is no CISA KEV entry supplied for this CVE, so active exploitation is not confirmed in the source material and no KEV remediation deadline or required action applies.
What's Vulnerable
- Vendor: MVPThemes
- Product: Jawn (WordPress theme)
- Affected versions: all versions from 0 through 1.4.2 (semver,
lessThanOrEqual: 1.4.2) - Default status for other versions: unaffected
No CPE entries were included in the NVD record.
Patch Status
The supplied data does not name a fixed version or reference a vendor patch advisory. Because everything up to and including 1.4.2 is marked affected and the default status is "unaffected," any release above 1.4.2 would be the place to check, but the source material does not confirm one exists. Operators running Jawn should consult the Patchstack and Wordfence entries below for current remediation guidance.