WordPress Photography theme (ThemeGoods Photography) contains a missing authorization flaw that allows attackers to bypass intended access control checks. By exploiting incorrectly configured security levels, an attacker can read, modify or delete content that should be protected, potentially enabling further compromise of the site. The weakness is a classic broken access control (CWE‑862).

All installations of ThemeGoods Photography versions n/a through 7.7.2 are affected. This includes any WordPress site that has loaded the theme prior to the release of the patched version. No support for newer or patched releases is indicated in the current data.

With a CVSS score of 6.3 the flaw is considered moderate, but the EPSS score of less than 1% indicates a low probability of exploitation at present, and it is not listed in CISA's KEV catalog. The vulnerability can be exploited by any actor who can access the public website, typically via HTTP requests to theme‑specific endpoints. No exploitation prerequisites beyond normal web access are stated, so the attack vector is assumed to be web‑based. If the attacker can identify an unprotected administrative or media endpoint exposed by the theme, the missing authorization check can be leveraged.