Technical impact
The vulnerability is a missing authorization flaw that permits unauthorized users to dismiss notices intended for privileged users. The weakness is a broken access control, allowing an attacker to perform an action they should not be able to perform. This can lead to unauthorized manipulation of administrative notices, potentially enabling further exploitation if subsequent actions depend on notice visibility.
Affected Systems
Rara Themes Metro Magazine theme versions from the earliest available up to 1.3.7 are affected. All WordPress installations using these theme versions are susceptible until the theme is upgraded to version 1.3.8 or later.
Risk and Exploitability
The CVSS score of 4.3 indicates a moderate impact, and the EPSS score is not available, so current exploitation probabilities are unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known, actively exploited flaw. However, the broken access control could be leveraged as a foothold for privilege escalation or other malicious actions, especially in sites where the Notice Dismissal function is a critical administrative control.
