CVE-2026-2278

Name of the Vulnerable Software and Affected Versions VW Writer Blog theme for WordPress versions prior to 1.3.9

Description The software allows unauthorized modification of data because the vw writer blog reset all settings() function lacks a proper capability check. Authenticated users with Subscriber-level access or higher can exploit this to reset all theme customizer settings to their default values.

Recommendations Update the VW Writer Blog theme to version 1.3.9 or later. As a temporary mitigation, restrict access to the vw writer blog reset all settings() function.