The plugin’s onMusic_ajax() function lacks a capability check, allowing authenticated users with subscriber-level access or higher to modify arbitrary WordPress options. By changing settings such as the default registration role to administrator and enabling user registration, an attacker can create a new administrator account and thereby gain full site control. The flaw is a classic missing authorization issue, categorized as CWE-862.

The vulnerability affects the SoundRise Music WordPress theme sold by IronTemplates. All releases up to version 1.6.11 are susceptible; the title indicates compatibility through 1.7, but the description limits it to 1.6.11, so any site running 1.6.11 or earlier must be considered at risk.

The CVSS score of 8.8 marks this flaw as high severity, yet the EPSS score indicates an exploitation probability of less than 1%, and it is not listed in the CISA KEV catalog. Attackers must first authenticate as a user with at least subscriber-level privileges, after which they can exploit the missing authorization check to elevate privileges. Because the flaw is confined to authenticated users, the attack vector is internal to the WordPress site.