The vulnerability is a broken access control flaw in the Industrial Lite WordPress theme, allowing users to bypass intended security checks and perform actions reserved for higher privileges. This flaw can enable unauthorized parties to view, modify, or delete theme settings and potentially access hidden content, compromising the confidentiality and integrity of the site’s data.

The issue affects all installations of the vowelweb Industrial Lite theme from the earliest releases through version 1.0.8 inclusive. Users running any of these versions on a WordPress installation are vulnerable.

The CVSS score of 4.3 indicates a moderate impact, yet the EPSS score of <1% and the absence from CISA’s KEV catalog suggest the likelihood of exploitation is low. Nevertheless, because the attack vector is inferred to be remote via a web request (the theme is actively loaded by the WordPress core), any exposed administrative interface could be abused. The combination of low severity and modest exploit probability does not negate the need for remediation, especially for sites that require strict content protection.