CVE-2026-88797

The Vayu X WordPress theme, in versions prior to 1.0.6 , is vulnerable to unauthorized plugin installation and activation. The root cause is a missing capability check on an AJAX action, which simultaneously exposes the protecting nonce to all logged-in users. This flaw allows any authenticated u...