CVE-2026-102383

Executive Summary

CVE-2026-102383 is a missing authorization vulnerability (CWE-862) in the VillaTheme Lookzy WordPress plugin, a WooCommerce lookbook/shoppable-image extension, affecting all versions from n/a through 1.1.14. The flaw allows an unauthenticated network attacker to reach functionality that should be restricted to authorized users because access control checks are absent or incorrectly configured. With a CVSS base score of 6.5, exploitation requires no privileges or user interaction and primarily enables integrity and availability impact on the affected WordPress site.

Technical Analysis

The vulnerability class here is missing authorization, mapped to CWE-862 ("Missing Authorization"). In the WordPress plugin ecosystem, this class typically arises when a plugin registers an AJAX action, REST API route, or admin-post handler without verifying the caller's capability via current_user_can() or a nonce/authorization check, or when an access control check is present but misconfigured (for example, checking only that a user is logged in rather than that the user holds the required capability).

The NVD description states the flaw "allows Exploiting Incorrectly Configured Access Control Security Levels." This wording indicates that some request handler in Lookzy is reachable by callers who should not be permitted to invoke it. Because the CVSS vector specifies PR:N (no privileges required) and UI:N (no user interaction), the vulnerable endpoint is reachable directly over the network by an unauthenticated client — no valid WordPress session or elevated role is necessary.

The attack surface is the WordPress HTTP interface exposed by a site running Lookzy. The plugin integrates with WooCommerce to render lookbooks (curated image collections with product hotspots), so it necessarily responds to front-end requests; the missing authorization check sits on a handler within that plugin surface that should have enforced a capability requirement.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L tells us the confidentiality impact is None, while integrity and availability impacts are Low, and the scope is unchanged (the vulnerable component and impacted component are the same). This profile is consistent with an unauthenticated caller being able to perform a limited state-changing action — modifying plugin-managed data or triggering a process that degrades availability — without being able to read sensitive data through this flaw.

It is important to be precise about what is and is not known. The NVD description and CNA title provided do not disclose the specific function name, AJAX action string, REST route, file path, or parameter involved. No CVE-specific proof-of-concept, Nuclei template, or exploit code has been published in the data supplied. Any specific endpoint or handler name would therefore be speculation and is not asserted here. Analysts should treat the vulnerability-class description above as the authoritative technical characterization available at this time.

Given the affected version ceiling (through 1.1.14), the vulnerable code exists in every release of the plugin up to and including that version. No patched version is identified in any tracked source.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing authorization) and the CVSS metadata (unauthenticated, network-reachable, low integrity/availability impact).

1. Reconnaissance / target identification. An attacker enumerates Internet-facing WordPress sites and fingerprints those running WooCommerce with the Lookzy plugin installed. Plugin presence is detectable from front-end asset paths and page markup served by the plugin, without authentication. Mass scanning of WordPress installs for known-vulnerable plugin versions is routine and can be executed with commodity tooling.

2. Triggering the flaw. Because CWE-862 means the authorization check is missing or incorrectly configured, the attacker issues a crafted HTTP request directly to the vulnerable plugin handler. Per the CVSS vector (PR:N, UI:N), this request can be sent anonymously over the network; the handler does not enforce the capability restriction it should. No credentials, session cookie, or administrator interaction is required.

3. Payload/execution at the vulnerability-class level. The attacker does not need to bypass an authentication mechanism or exploit a memory-safety bug; the access control layer simply does not block the request. The request is accepted and processed even though the caller lacks the privileges the operation was designed to require. The precise request structure cannot be specified from the available data, because the endpoint, action, and parameters are not disclosed in the NVD description or CNA title.

4. Post-exploitation impact. Consistent with the CVSS subscores, the attacker achieves Low integrity and Low availability impact with no confidentiality impact. In practice this corresponds to unauthorized modification of plugin-managed content or state (integrity) and/or triggering an action that consumes resources or disrupts plugin functionality (availability). The unchanged scope (S:U) indicates the impact remains within the vulnerable plugin component rather than pivoting to full site compromise via this flaw alone. However, unauthorized state changes on a WooCommerce-integrated plugin can cascade into storefront integrity issues — for example, tampering with lookbook content that drives product presentation or promotions — and should be treated as a business-impacting exposure even at Low severity.

Because only the vulnerability class is known, defensive teams should assume the vulnerable handler accepts unauthenticated input and should focus detection on anomalous anonymous requests reaching the plugin's request surface rather than on a single known signature.

Impact Assessment

Business impact centers on the integrity of plugin-managed data and the availability of the affected functionality on a public commerce site. The CVSS base score of 6.5 (Medium) reflects network reachability, low attack complexity, no privileges or interaction required, and Low integrity and availability impact with no confidentiality impact and unchanged scope.

Affected systems are WordPress installations running WooCommerce with the VillaTheme Lookzy plugin at version 1.1.14 or earlier. Because the flaw is unauthenticated and remotely reachable, the blast radius is any Internet-exposed instance of the affected plugin that has not been removed or otherwise protected. E-commerce sites are the primary concern: Lookzy is tied to shoppable lookbook/merchandising content, so unauthorized tampering can undermine customer-facing merchandising integrity, promotions, or product presentation, with potential downstream reputational and revenue consequences.

The impact is capped at Low for integrity and availability per the vector, so this is not a full-site-takeover or data-exfiltration vulnerability in itself. Nevertheless, missing authorization flaws on unpatched plugins are frequently chained with other weaknesses and are attractive to opportunistic mass-exploitation campaigns because they require no authentication and no victim interaction. The EPSS score is not yet available from FIRST.org, so no probabilistic exploitation estimate can be cited; absence of a public PoC and absence from CISA KEV both indicate no confirmed in-the-wild activity at this time.

Detection Guidance

Sigma Rule

title: Potential VillaTheme Lookzy Missing Authorization Exploitation (CVE-2026-102383)
id: 3f9c1b42-7d2a-4e18-9c6b-1a0e5f7c2d91
status: experimental
description: Detects unauthenticated or low-privilege HTTP requests targeting the VillaTheme Lookzy WordPress plugin request surface, which may indicate exploitation of CVE-2026-102383 (CWE-862 missing authorization).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102383
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'lookzy'
      - 'woo-lookbook'
  selection_state_change:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
  filter_authenticated:
    cs-cookie|contains: 'wordpress_logged_in'
  condition: selection_plugin and selection_state_change and not filter_authenticated
falsepositives:
  - Legitimate anonymous front-end lookbook interactions
level: medium

YARA Rule

rule CVE_2026_102383_Lookzy_Missing_Auth
{
    meta:
        author = "valtersit.com"
        description = "Detects VillaTheme Lookzy plugin PHP source referencing request handling consistent with CVE-2026-102383 missing authorization"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102383"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $plugin1 = "lookzy" nocase
        $plugin2 = "woo-lookbook" nocase
        $wp1 = "wp_ajax_nopriv_" ascii
        $wp2 = "admin_post_nopriv_" ascii
        $rest = "register_rest_route" ascii
        $cap = "current_user_can" ascii

    condition:
        (uint32(0) == 0x3C3F7068 or uint32(0) == 0x68703F3C) and
        ($plugin1 or $plugin2) and
        ($wp1 or $wp2 or $rest) and
        not $cap
}

Note: this rule is a heuristic hunting aid for locating plugin code that registers unauthenticated entry points; it does not confirm exploitability. Because the specific vulnerable handler is not disclosed in the CVE data, no exact function name is matched.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102383 VillaTheme Lookzy Missing Authorization Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"lookzy"; nocase; http.cookie; content:!"wordpress_logged_in"; nocase; reference:cve,2026-102383; classtype:attempted-user; sid:2026102383; rev:1;)

This signature flags unauthenticated POST requests whose URI references the Lookzy plugin path. It is intentionally broad because the exact vulnerable action/endpoint is not disclosed; tune the http.uri content to the observed plugin path in your environment.

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "POST" and
     stringContains(http.request.uri, "lookzy") and
     not stringContains(http.request.headers, "wordpress_logged_in")]

This EQL detects unauthenticated POST traffic to the Lookzy plugin surface within a short window, highlighting single-source exploitation attempts.

Splunk SPL Query

index=web OR index=proxy
(http.url="*lookzy*" OR http.url="*woo-lookbook*")
(NOT http.cookie="*wordpress_logged_in*")
| stats count values(http.url) as urls values(http.method) as methods by src_ip, status
| where count > 3
| sort - count

This query surfaces repeated unauthenticated requests to the plugin surface from a single source, a common pattern for automated exploitation scanning.

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-102383,">
  <rule id="2026102" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>lookzy|woo-lookbook</url>
    <regex>POST</regex>
    <match>HTTP/1</match>
    <description>CVE-2026-102383: Possible VillaTheme Lookzy missing authorization exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• If the Lookzy plugin is not actively required, deactivate and remove it. Removing the vulnerable component eliminates the attack surface entirely and is the most reliable interim control given there is no patch.
• If the plugin must remain active, restrict access to the plugin's request surface. Where the site architecture allows, use a web application firewall (WAF) or reverse-proxy rule set to block or challenge unauthenticated requests to the Lookzy plugin paths, allowing only expected front-end traffic patterns.
• Enforce authentication at the edge for any non-public plugin functionality, and review whether the plugin's public-facing features can be served as static assets or via caching so that dynamic handlers are not directly exposed.
• Monitor web access logs for the anomalous unauthenticated request patterns described in the Detection Guidance section.

2. Patch/upgrade steps:

• As of this assessment there is no vendor fix, no patch reference, and no fixed version identified in any tracked source. Affected versions are those through 1.1.14. Do not assume a fixed release exists.
• Monitor the VillaTheme vendor channels and the WordPress plugin repository for an updated Lookzy release. When a fixed version is published, apply it immediately and verify the installed version.
• If a fixed release is not forthcoming, treat the plugin as permanently untrusted and prefer removal over indefinite compensating controls.

3. Long-term hardening:

• Maintain an inventory of installed WordPress plugins and versions, and map them against CVE feeds continuously so that a fix can be applied the moment one is available.
• Enforce least privilege and validate authorization on every request handler; for custom or third-party plugins, review that handlers enforce capability checks (for example via current_user_can()) and nonce verification rather than relying on authentication alone.
• Deploy a WAF with virtual patching capability to buy time for vulnerable plugins for which no patch is available.
• Subscribe to vulnerability intelligence for the WooCommerce/WordPress ecosystem and prioritize unauthenticated network-reachable flaws such as CWE-862, which require no credentials or user interaction to exploit.

References

• NVD — CVE-2026-102383: https://nvd.nist.gov/vuln/detail/CVE-2026-102383
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102383 not listed as of this assessment): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• VillaTheme official plugin/product site (monitor for a fixed Lookzy release): https://villatheme.com/
• WordPress Plugin Security guidance: https://developer.wordpress.org/plugins/security/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-102383 in the data provided. No public PoC or Nuclei template exists, and EPSS has not yet scored this CVE.