PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-103080 VillaTheme CVE debrief

The CVE-2026-103080 vulnerability affects the WordPress Salevo plugin, versions up to and including 1.3.0. This issue is related to broken access control, allowing for input data manipulation. The CVSS score for this vulnerability is 5.3, indicating a medium severity level. Defenders and administrators of WordPress environments using the Salevo plugin should be aware of this vulnerability and take necessary actions to secure their environments. The vulnerability allows for input data manipulation due to broken access control, which could lead to unauthorized changes within the WordPress environment. It is crucial for defenders to verify plugin versions, review access controls, and

Vendor
VillaTheme
Product
Salevo
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders and administrators of WordPress environments using the Salevo plugin should be aware of this vulnerability and take necessary actions to secure their environments.

Why it matters

CVE-2026-103080 is a medium-severity vulnerability in the WordPress Salevo plugin that allows for input data manipulation due to broken access control. Defenders should verify plugin versions, review access controls, and monitor for suspicious activity to mitigate potential risks.

  • Defenders need to verify the version of the Salevo plugin to ensure it is not vulnerable.
  • Input data manipulation could lead to unauthorized changes within the WordPress environment.
  • Defenders should review and enhance access controls to prevent exploitation.
  • Verification of plugin updates and monitoring for suspicious activity are crucial.

Technical summary

The CVE-2026-103080 vulnerability is related to a broken access control issue in the WordPress Salevo plugin, versions up to and including 1.3.0. This vulnerability allows for input data manipulation and has a CVSS score of 5.3, indicating a medium severity level.

Defensive priority

Defenders should prioritize verifying the version of the Salevo plugin in use and ensuring it is updated to a version beyond 1.3.0 if possible. They should also review access controls and data manipulation protocols within their WordPress environments.

Recommended defensive actions

  • Verify the version of the Salevo plugin in use and update to a version beyond 1.3.0 if possible.
  • Review access controls and data manipulation protocols within WordPress environments.
  • Monitor for any suspicious activity related to input data manipulation.

Evidence notes

The evidence provided includes details from the CVE Program record, the NVD vulnerability detail page, and the source item from cve_program_cvelist_v5. These sources indicate a broken access control vulnerability in the Salevo plugin, allowing for input data manipulation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-103080 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-103080

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-103080 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-103080

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.