The vulnerability is an incorrect privilege assignment in the pebas CouponXL WordPress theme. It allows a legitimate user to elevate their privileges to an administrative level, compromising confidentiality, integrity, and availability of the site. The weakness corresponds to CWE-266, which focuses on unauthorized privilege escalation.

The issue affects all versions of the pebas CouponXL theme from the earliest release through version 4.5.0. The CVE description explicitly states that CouponXL couponxl is vulnerable up to and including 4.5.0. This applies to any WordPress installation that has that theme installed, regardless of the current user role at the time of installation.

The CVSS score of 9.8 indicates a critical severity level. However, the EPSS score of less than 1% suggests that real‑world exploitation is currently very unlikely, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires a valid authenticated account that can interact with the theme’s back‑end functionality; the attacker could then leverage the incorrect privilege assignment to gain higher level permissions. The exploit path is therefore limited to environments where the theme is active and users can trigger the affected functionality.