The Bulk theme plugin for WordPress contains a missing authorization flaw that permits users lacking proper privileges to invoke administrative functions that should be restricted. This broken access control can lead to unauthorized configuration changes or data exposure within the site, as the vulnerability arises from improper enforcement of ACLs in the plugin’s code. The weakness is classified as CWE-862.

Bulk theme (Themes4WP:Bulk) from any prior release up through version 1.0.11. Although the product identifier is “Themes4WP:Bulk,” the vulnerability affects all deployments of this theme until an update beyond 1.0.11 is installed.

The CVSS base score of 5.3 indicates a moderate risk, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely occur through normal web requests to the theme’s publicly exposed endpoints; an attacker needs only valid user credentials that grant some level of site access but not administrative rights. Once the attacker interacts with the vulnerable functions, they can perform privileged operations that should otherwise be forbidden.