PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59535 Thrive Themes Coupon CVE debrief

CVE-2026-59535 is a HIGH-severity vulnerability in Thrive Product Manager plugin versions <= 10.9.2. It allows unauthenticated broken access control, with a CVSS score of 7.3. The vulnerability class is broken access control. Likely operational impact includes unauthorized access. Source confidence is high based on CVE and NVD data. Review context includes official CVE and NVD records.

Vendor
Thrive Themes Coupon
Product
Thrive Product Manager
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Users of Thrive Product Manager plugin versions <= 10.9.2 should apply patches or mitigations to prevent exploitation. Affected operators include administrators and users of the plugin. Platform impact includes WordPress environments. Vulnerability-management impact includes prioritizing patching.

Technical summary

The vulnerability is caused by unauthenticated broken access control in Thrive Product Manager plugin versions <= 10.9.2. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Affected product context includes Thrive Product Manager plugin. Defensive impact includes patching or mitigating the vulnerability.

Defensive priority

High priority should be given to patching or mitigating this vulnerability due to its HIGH severity and potential for exploitation.

Recommended defensive actions

  • Apply patches or updates to Thrive Product Manager plugin to version > 10.9.2
  • Implement compensating controls to restrict access to the plugin
  • Monitor for suspicious activity or exploitation attempts
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-27T15:17:04.070Z and last modified on 2026-07-27T17:46:02.447Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD data. Defenders should verify affected product deployments and review official advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-59535 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-59535

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-59535 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-59535

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.