CVE-2026-66691

CVE-2026-66691 in the Nokri theme exposes a registration flaw that's become endemic to the WordPress theme ecosystem. The handler was registered using `wp_ajax_nopriv_`, which means it executes for unauthenticated users by default — the developer must then actively deny access. This inverts the security model: the dangerous state requires no code, the safe state requires explicit capability checks. Under deadline pressure, the path of least resistance wins. What makes this case instructive isn't the individual slip — it's the multi-version span. The flaw persisted through version 1.6.6, meaning it survived months of updates, commits, and releases without being caught. That points to something worse than a moment of developer inattention: the entire review infrastructure around WordPress themes is structurally blind to this vulnerability class. The expected standard in theme development was the insecure default, so code review had no baseline to flag against. This is also not an isolated case. The same `wp_ajax_nopriv_` misconfiguration pattern appears in CVE records going back at least a decade — each gets its own CVE, its own patch, and no systemic remedy. The security community has documented the pattern repeatedly but never built the tooling to catch it at scale. Static analysis can identify `nopriv_` hooks missing `current_user_can()` checks, but no standard linter rule or CI pipeline targets this vulnerability genotype. For defenders: audit your installed themes and plugins for any `wp_ajax_nopriv_` handlers and verify each one has explicit capability checks — not just that it works for logged-in users. Treat any unauthenticated AJAX endpoint touching user data, credentials, or account state as a high-priority finding. Given the theme ecosystem's uneven update cadence and the lack of systematic remediation tracking, assume this vulnerability class exists in multiple other active themes and plan accordingly.

Reviewed through automated stages and approved by a human before publication.