CVE-2025-53986

WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability

Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from n/a through <= 3.2.10.

We have discovered 13,935 live websites that are affected by CVE-2025-53986.

Run a Free Instant Scan



Affected Software

Product  Hestia
Category Wordpress Themes
Vulnerable Domains13,935 live websites (54% of Hestia install base)
Vulnerable Versions
  • from 0 through 3.2.10
Vulnerable Versions Count132 versions ( 95% of all versions)



Details

  • Published - Jul 16, 2025
  • Updated - Apr 28, 2026

Credits

  • Martino Spagnuolo (r3verii) | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2025-53986
United States2,627 websites


Germany1,780 websites
France1,573 websites
Poland697 websites
Italy631 websites
Netherlands612 websites
GB544 websites
Japan429 websites
Spain338 websites
Russia338 websites

Website Distribution by TLD

Number of websites using CVE-2025-53986
.com4,345 websites
.de1,185 websites
.fr746 websites
.org688 websites
.nl569 websites
.pl550 websites
.it462 websites
.net347 websites
.co.uk302 websites
.cz272 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-53986

Top websites that are affected by CVE-2025-53986. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.com United States**,***
****************.com United States**,***
*********.com France***,***
***************.***********.net ***,***
*********.de Germany***,***
************.us United States***,***
********.com Italy***,***
***************.com United States***,***
**********.news United States***,***
********.******.fr France***,***
See full domain list

FAQ

A total of 13,935 websites have been identified as vulnerable to CVE-2025-53986, based on global website indexing conducted by WebTechSurvey.
The Hestia is affected by the CVE-2025-53986 vulnerability.
Hestia versions up to and including 3.2.10 are vulnerable to CVE-2025-53986.