The vulnerability is a missing authorization flaw that allows an attacker to bypass the intended access restrictions of the MetroStore theme. An attacker could read or modify data, settings, or other protected functionality within a WordPress site, thereby compromising confidentiality or integrity. This is categorized as CWE‑862, indicating a broken access control weakness.

The issue affects Sparkle WP’s MetroStore theme for all released versions up to and including 1.3.2. Any WordPress installation using this theme version is potentially vulnerable.

The CVSS score of 4.3 denotes a moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely based on incorrect configuration of access levels within WordPress; attackers with sufficient privileges to interact with the theme (such as logged‑in users with certain roles) could exploit the flaw. The risk is limited to the scope of the compromised access rights, but remediation is still recommended to prevent unauthorized operations.