The Zegen - Church WordPress Theme contains a missing capability check on several AJAX endpoints. This flaw allows any authenticated user with Subscriber-level access or higher to import, export, and update theme options. The weakness corresponds to CWE-862, lacking proper authorization enforcement. An attacker can import, export, and update theme options.

The vulnerability affects the Zegen - Church WordPress Theme delivered by zozothemes. All releases up to and including version 1.1.9 are impacted, including any WordPress site that has installed these versions of the theme.

The CVSS score of 4.3 places this issue in the moderate severity range, indicating that while it does not enable full code execution, it grants significant administrative control over theme configuration. The EPSS score of less than 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an authenticated user; an attacker must first obtain legitimate login credentials or a session cookie to benefit from the missing authorization. Once authenticated, the attacker can exploit the unprotected AJAX endpoints to alter theme options.