The Felan Framework WordPress theme contains a missing capability check in the AJAX handler 'process_plugin_actions'. Any visitor, regardless of authentication status, can call this endpoint and instruct the site to activate or deactivate installed plugins. Because this action does not enforce the appropriate permission, it allows an attacker to alter plugin states. Based on the description, it is inferred that an attacker could activate a malicious plugin or disable security‑related plugins, potentially compromising integrity or availability.

All installations of the Felan Framework theme supplied by RiceTheme up to and including version 1.1.4 are vulnerable. The flaw is confined to the process_plugin_actions function used by the theme’s WordPress AJAX endpoint.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, suggesting a low current exploitation probability. The attack vector is unauthenticated and remote, requiring only a crafted AJAX request. Successful exploitation gives the attacker the ability to alter plugin states; based on the vulnerability, this could enable execution of arbitrary code if a malicious plugin is activated, but the description does not explicitly confirm this outcome.