Technical impact
The Rozario theme contains a missing authorization flaw that enables attackers to bypass access controls. This flaw allows unauthorized users to invoke theme‑provided functions or access sections that should be restricted. The associated weakness is CWE‑862. The impact is that an attacker could create, modify, or delete content, execute arbitrary actions, or gain elevated privileges within the WordPress site.
Affected Systems
All releases of the Rozario theme version 1.4 and earlier, distributed by themeton, are affected. WordPress sites that use Rozario up to version 1.4 should be considered vulnerable.
Risk and Exploitability
The CVSS score of 5.3 classifies the vulnerability as medium severity, but the EPSS score of less than 1% indicates a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the WordPress environment, where an attacker can send requests to endpoints handled by Rozario that lack proper authorization checks. No specific prerequisite access level is stated; the flaw allows bypassing authorization checks regardless of the attacker's credential level.
EUVD