CVE-2026-12471

Name of the Vulnerable Software and Affected Versions Spexo theme for WordPress versions prior to 2.0.12

Description Unauthorized access is possible due to a missing capability check in the activate plugin() function. This allows authenticated users with Subscriber-level permissions or higher to activate a limited set of plugins.

Recommendations Update the Spexo theme to version 2.0.12 or later. As a temporary mitigation, restrict user roles to prevent Subscriber-level accounts from accessing functions related to plugin activation.