The vulnerability is a missing authorization check in the Rocket Apps wProject WordPress theme, allowing any visitor to modify or delete content such as posts, comments, or attachments without authentication. This can lead to defacement, data loss, or manipulation of site content, potentially undermining the site’s integrity and reliability.

All installations of the Rocket Apps wProject theme that are running versions earlier than 5.8.0 are affected. The vulnerability applies to all WordPress sites that have the theme active and have not applied the fix released in version 5.8.0 or later.

The CVSS score of 8.2 classifies the weakness as high severity, and the EPSS score of less than 1% indicates a low but nonzero probability of exploitation. The attack requires the presence of the theme on a WordPress site and does not rely on any user authentication; an unauthenticated user can trigger the vulnerable functionality, typically through the theme’s exposed endpoints or REST API. The vulnerability is not currently listed in CISA’s KEV catalog, meaning no widespread, known exploitation is documented at this time.