The Vikinger WordPress theme contains a flaw in the vikinger_user_meta_update_ajax function that fails to properly restrict user meta updates, which is a vulnerability classified as CWE‑269 (Privilege Validation Required). As a result, any authenticated user with Subscriber level access or higher can bypass normal role checks and gain Administrator privileges. This elevation can lead to complete control over the site, including the ability to install plugins, alter settings, and access sensitive information.

Vendors: Odin_Design. Product: Vikinger theme for WordPress. Versions affected: all releases up to and including 1.9.30. Users running these versions may be vulnerable if an attacker can authenticate as a Subscriber or higher role.

The CVSS score of 8.8 indicates a high severity exposure, while an EPSS score of <1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers need only valid user credentials with Subscriber or higher role to trigger the exploit, making it an authenticated privilege escalation rather than a remote code execution.