The vulnerability in the Houzez WordPress theme is a missing authorization flaw that allows an attacker to bypass normal user permissions. As a result, an unauthenticated or low‑privileged user could gain access to functions reserved for administrators, thereby creating or modifying content or user accounts. This broken access control is classified as CWE‑862, indicating that the application does not properly validate that the requesting user is allowed to perform the operation.

The problem affects sites that use the Favethemes Houzez theme, from initial release through version 3.4.0. Any WordPress installation that has the theme in place and has not applied a later release is potentially vulnerable.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity. The EPSS score is less than 1%, so the probability of real‑world exploitation is low. The issue is not listed in the CISA KEV catalog. The likely attack path involves interacting with the theme’s web interfaces, and although the description does not detail successful exploitation proof, it is inferred that the weak access checks could be abused through normal theme‑provided endpoints.