The vulnerability in the Cardealer WordPress theme allows an authenticated user with subscriber or higher capabilities to modify or delete JavaScript and CSS files through AJAX functions that lack proper capability checks and filename sanitization. This shortfall enables an attacker to alter styles and scripts that affect the visual presentation and client‑side behaviour of the site, potentially rendering pages unusable or enabling the injection of malicious code. The impact is limited to data modification and availability rather than arbitrary code execution, but it undermines the integrity of the theme’s assets.

WordPress sites that use the ThemeMakers Car Dealer Automotive WordPress Theme – Responsive, versions up to and including 1.6.4, are susceptible.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of active exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Although the attack vector is not explicitly stated, it is inferred that the exploitation occurs via web‑based AJAX endpoints that an authenticated user can reach, so the threat requires legitimate user credentials but no elevated privileges.