The vulnerability is a missing authorization flaw that allows the exploitation of incorrectly configured access control security levels. Attackers can perform operations that should be restricted, potentially altering or exposing sensitive data. The primary impact is the circumvention of intended privilege limits, which can lead to unauthorized data modification or disclosure.

WordPress users employing the themeton "The Business" theme with version 1.6.1 or earlier are affected. The issue applies to all releases through 1.6.1.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, through web requests to the theme’s administrative or exposed pages, and may require a user to be authenticated or rely on misconfigured access controls that allow unauthenticated access. Although the technical barrier is moderate, the potential for privilege escalation warrants attention.