The Streamit WordPress theme contains a flaw in the profile editing routine that fails to verify the current user’s identity before allowing changes to user attributes. This oversight lets an attacker, even without authentication, alter any user’s email address. By resetting the new email through WordPress’ password recovery mechanism, the attacker can assume the victim’s account, granting full administrative privileges.

All WordPress sites that have the iqonicdesign Streamit theme installed at version 4.0.2 or earlier are affected. The vulnerability is present in Streamit versions up to and including 4.0.2.

The CVSS base score of 8.8 reflects a severe risk for systems running legacy Streamit, while the EPSS score of less than 1% indicates low but non‑zero exploitation probability. Because the issue can be exploited via a simple POST request to the site, attackers with network access to the host can trigger it without any credentials. The vulnerability is not listed in CISA’s KEV catalog, so no public exploit reports are known, but the high severity and trivial exploitation path warrant urgent mitigation.