The Acerola theme for WordPress implements a missing authorization check that permits users to exploit incorrectly configured access control settings. This results in unauthorized access to privileged functions provided by the theme. The flaw is classified as CWE‑862 and allows anyone who can trigger the vulnerable functionality to perform actions that should be restricted to users with appropriate privileges.

Acerola theme versions up to and including 1.6.5 from the vendor themeton are affected. Any instance of the theme deployed on a WordPress site, regardless of the site’s overall security posture, is vulnerable if its version is 1.6.5 or earlier.

The vulnerability scores a CVSS of 5.3, indicating a moderate impact. The EPSS is below 1 %, suggesting a low likelihood of widespread exploitation at this time. It is not listed in the CISA KEV catalog, and the attack vector is inferred to be web‑based, requiring the attacker to reach and invoke UI or API endpoints provided by the theme. The potential impact is the unauthorized execution of privileged theme operations, but it does not provide remote code execution or data exfiltration beyond the scope of theme‑controlled functionality.