The vulnerability is a broken access control flaw in the Xpro Theme Builder plugin that removes necessary authorization checks, allowing an attacker to perform actions on the site they should not have permission to execute. The impact includes unauthorized reading, editing, or deletion of site content and configuration, which could lead to data integrity issues, site defacement, or further compromise of the WordPress installation. This weakness corresponds to CWE-862, Authorization Bypass Through User-Controlled Data.

The vendor Xpro provides the Xpro Theme Builder plugin. All releases up to and including version 1.2.8.4 are affected; no earlier version boundary is specified in the advisory. WordPress sites utilizing any of these plugin versions are at risk until the issue is patched.

The assessed CVSS score is 4.3, indicating moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not catalogued under the CISA Known Exploited Vulnerabilities (KEV). Because the flaw is an authorization bypass, the typical exploitation route would involve an authenticated user or an attacker that can masquerade with elevated privileges; this inference is based on the nature of the weakness and the description. Successful exploitation would allow the attacker to conduct unauthorized actions through the plugin’s exposed functionality.