CVE-2023-46148 is a high severity (CVSS 8.8) missing authorization flaw in the Themify Ultra WordPress theme, affecting versions through 7.3.5. The linked advisory title describes an authenticated arbitrary settings change. We could not read the fixed version for this CVE, so update to the latest release and verify in the changelog.
What's affected
The record says Themify Ultra is affected from n/a through 7.3.5 and names no fix. The Patchstack page linked from the record has a title describing an authenticated arbitrary settings change. Our fetch of it was blocked, so we could not read its fixed version. The sibling advisory for CVE-2023-46145 on the same theme names 7.3.6 as fixed.
So the evidence is consistent but indirect. Treat 7.3.5 and below as exposed, and move to the latest release after reading the vendor changelog. The vector requires a low privilege login and gives high impact to confidentiality, integrity and availability.
The NVD record scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-862 (missing authorization). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
List theme versions with:
wp theme list --fields=name,version,status
Or open Appearance and Themes in the admin. Then compare theme settings against your last known good state, since the described flaw lets a low privilege user change settings. Look for unexpected redirects, injected scripts or changed layout options.
What to do now
- Update Themify Ultra to the latest version and read the changelog for access control fixes.
- Compare current theme options against a recent backup and revert anything you did not change.
- Audit user accounts and remove those you do not recognise.
- Turn off open registration if the site does not need it.
- Keep a record of which sites run this theme.
Why it matters
A missing authorization check lets any logged in account call code that should be limited to administrators. Changing arbitrary settings is a quiet kind of damage, because a site can look normal while a script or redirect has been added.
The class is CWE-862. It is easy to prevent in code with a capability check on every handler, and hard to notice from outside. That is why updating promptly and auditing settings are the right two moves.
Quick check
Is this the same as CVE-2023-46146?
No. Both are missing authorization flaws in the same theme, with separate records and scores.
What should I audit after updating?
Theme settings, user accounts and any injected scripts or redirects.
Sources
Last reviewed: 19 October 2026.
