The Mega Store Woocommerce theme contains a missing capability check in the setup_widgets() function that allows users with Subscriber-level or higher access to create arbitrary pages and modify site settings. This flaw directly violates authorization controls (CWE‑862) and enables an attacker who possesses at least Subscriber privileges to change content that normally requires higher administrative rights.

WordPress sites that have installed the Mega Store Woocommerce theme, versions 5.0 through 5.9 inclusive, are affected. Administrators using these versions are at risk if they have users with Subscriber or higher roles.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only authenticated access with a Subscriber role, and the attack path is essentially the normal import or widget setup flow exposed by the theme. Because the flaw bypasses a capability check, an attacker can use existing permissions to arbitrarily alter site content and settings, potentially impacting confidentiality and integrity of the site’s data.