The Resido real‑estate WordPress theme allows unauthenticated users to call the delete_api_key and save_api_key AJAX actions without a capability check. This omission permits attackers to send requests to internal services and alter the API key settings of the site, effectively bypassing authorized controls and exposing sensitive credentials or facilitating further access through internal network resources.

Any WordPress installation using the SmartDataSoft Resido theme version 3.6 or earlier is vulnerable. The issue resides in the listed themelist and is not limited to a specific sub‑plugin or configuration variant.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of exploitation in the wild. The vulnerability is not yet listed in CISA's KEV catalog, suggesting that large‑scale attacks are not currently observed. Attackers would need only to craft unauthenticated AJAX requests targeting the vulnerable theme’s endpoints, a simple technique that can be automated if the vulnerability is publicly known.