The vulnerability is a privilege assignment flaw in the Rocket Apps wProject WordPress theme that allows a malicious actor with a Subscriber role to perform actions normally reserved for administrators, effectively bypassing the intended access controls and raising the user’s privileges. This weakness falls under CWE-266 – Incorrect Privilege Assignment.

All installations of the wProject theme for WordPress running a version older than 5.8.0 are affected, meaning any pre-5.8.0 release of the Rocket Apps theme is vulnerable.

The CVSS score of 8.8 signals high impact, the EPSS score is below 1 percent indicating low exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. A likely attack vector is an authenticated user with Subscriber role acting through the WordPress admin interface; once privilege escalation is achieved, the attacker could modify site settings, publish content, or compromise other user accounts.