The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme contains a missing capability check in the cmsmasters_hide_admin_notice function. This flaw allows an authenticated user with Subscriber role or higher to change theme option values. Because these options can control error handling, registration settings, or other critical behaviors, an attacker can corrupt configuration data and trigger an error that disrupts user access, potentially leading to a denial of service. The weakness is a classic missing authorization flaw, labeled CWE‑862.

Vendors: cmsmasters. Product: Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme. Versions affected are all releases up to and including 2.0.4.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% shows low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, reflecting the limited exploit activity so far. Attackers must authenticate with a Subscriber or higher account to exploit the flaw, which narrows the attack window to users who can log in. Once authenticated, the user can modify options to create site errors or disrupt services without requiring any additional privileges.