PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59535 Thrive Themes Coupon CVE debrief

CVE-2026-59535 is a HIGH-severity vulnerability in Thrive Product Manager plugin versions <= 10.9.2. It allows unauthenticated broken access control, with a CVSS score of 7.3. The vulnerability class is broken access control. Likely operational impact includes unauthorized access. Source confidence is high based on CVE and NVD data. Review context includes official CVE and NVD records.

Vendor
Thrive Themes Coupon
Product
Thrive Product Manager
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Users of Thrive Product Manager plugin versions <= 10.9.2 should apply patches or mitigations to prevent exploitation. Affected operators include administrators and users of the plugin. Platform impact includes WordPress environments. Vulnerability-management impact includes prioritizing patching.

Technical summary

The vulnerability is caused by unauthenticated broken access control in Thrive Product Manager plugin versions <= 10.9.2. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Affected product context includes Thrive Product Manager plugin. Defensive impact includes patching or mitigating the vulnerability.

Defensive priority

High priority should be given to patching or mitigating this vulnerability due to its HIGH severity and potential for exploitation.

Recommended defensive actions

  • Apply patches or updates to Thrive Product Manager plugin to version > 10.9.2
  • Implement compensating controls to restrict access to the plugin
  • Monitor for suspicious activity or exploitation attempts
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-27T15:17:04.070Z and last modified on 2026-07-27T17:46:02.447Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD data. Defenders should verify affected product deployments and review official advisories.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T15:17:04.070Z and has not been modified since then. The NVD entry is currently Deferred.