CVE-2023-46146 is a high severity (CVSS 8.3) missing authorization flaw in the Themify Ultra WordPress theme, affecting versions through 7.3.5. The record names no fixed version for this CVE. A sibling advisory lists 7.3.6, so update to the newest release and confirm with Themify or Patchstack.
What's affected
The record says Themify Ultra is affected from n/a through 7.3.5. It gives no fixed version for this specific CVE. The Patchstack page linked here is titled as multiple broken access control issues, and our fetch of it was blocked, so we could not read it. The Patchstack page for the sibling CVE-2023-46145 names 7.3.6 as the fixed version for the same theme.
Because of that gap, state it plainly: the fix is probably in 7.3.6, but check the vendor changelog before you rely on it. The vector shows a network attack needing a low privilege login, with a limited confidentiality impact and high integrity and availability impact.
The NVD record scores it 8.3 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. The weakness class is CWE-862 (missing authorization). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
From the command line:
wp theme list --fields=name,version,status
Or read the version from Appearance and Themes in the WordPress admin. Anything at 7.3.5 or below is in range. Also check whether child themes are in use, and review recently created low privilege accounts.
What to do now
- Update Themify Ultra to the latest release and confirm in the changelog that access control fixes are included.
- Review user accounts and remove unexplained ones.
- Disable open registration if you do not need it.
- Take a backup before updating, then test the front end and the admin.
- Record the theme and version in your inventory.
Why it matters
Missing authorization means a function runs without checking whether the caller is allowed to use it. In WordPress themes this often shows up in handlers reachable by any logged in user. The weakness class is CWE-862.
The result is that a low privilege account can reach actions meant for administrators. Sites with open registration are the easiest to reach. Keeping themes current is the practical control.
Quick check
Which version fixes it?
The record does not say. A sibling advisory for the same theme names 7.3.6. Check the vendor changelog.
Does an attacker need an account?
Yes, the vector requires low privileges.
Sources
Last reviewed: 19 October 2026.
