Missing authorization in the Soledad theme allows attackers to trigger features that should be restricted by ACLs, potentially exposing sensitive data or enabling unauthorized actions. The vulnerability can lead to exploitation of account privileges or misconfiguration, possibly resulting in data compromise or unauthorized content modifications.

TemplateHouse Soledad premium theme, all versions up to and including 8.2.5, is impacted. WordPress sites using any of these versions are susceptible to the missing ACL enforcement.

With a CVSS score of 5.4, the flaw represents medium severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user or compromised account exploiting the theme’s unsecured functionality; mitigation requires patching.