CVE-2023-46145 is a high severity (CVSS 8.8) improper privilege management flaw in the Themify Ultra WordPress theme. A logged in user with a low privilege account can escalate. Affected versions run through 7.3.5, and Patchstack lists 7.3.6 as the fixed version, so update the theme.
What's affected
The record says Themify Ultra is affected from n/a through 7.3.5. The Patchstack entry says the same, and names version 7.3.6 as the fix. It also says the attacker needs only a Subscriber level account, rated High priority at CVSS 8.8.
There is a small discrepancy to be aware of. The Patchstack page address mentions 7.3.3 while the affected range in both sources runs through 7.3.5. Go by the range, and treat anything at or below 7.3.5 as exposed. Two related records, CVE-2023-46146 and CVE-2023-46148, cover missing authorization in the same theme.
The NVD record scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-269 (improper privilege management). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
If you manage WordPress from the command line:
wp theme list --fields=name,version,status
Otherwise open Appearance and Themes in the admin panel and read the version on the Themify Ultra card. Check child themes too, since they inherit the parent's code. Also review the Users screen for accounts you do not recognise, especially recent Subscriber registrations, and look for unexpected Administrator accounts.
What to do now
- Update Themify Ultra to 7.3.6 or later on every site, including staging copies.
- Review all user accounts and remove any you cannot explain.
- If public registration is open and you do not need it, turn it off until you have updated.
- Check that no unknown administrators or new plugins appeared since the theme was installed.
- Add the theme to your inventory so future advisories match automatically.
Why it matters
Improper privilege management means the code lets an account do more than its role allows. In WordPress that often means a handler that runs for any logged in user without checking capability. Sites that allow open registration give an attacker the low privilege account they need for free.
The weakness class is CWE-269. The impact here is high across confidentiality, integrity and availability, because an administrator on a WordPress site can install code. Updating the theme is the only fix the sources give.
Quick check
Do I need to be an administrator to abuse it?
No. The advisory says a Subscriber level account is enough.
Is this exploited in the wild?
Neither the record nor the advisory we read says so, and it is not in CISA KEV.
Sources
Last reviewed: 19 October 2026.
