The vulnerability in the Golo – City Travel Guide WordPress Theme allows an unauthenticated attacker to set an authorization cookie for any user by providing that user’s email address. This bypasses the theme’s identity validation, granting the attacker full privileges, including administrative rights. It is an instance of improper authentication (CWE‑288) and effectively leads to a direct account takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.

All deployments of the Golo theme produced by uxper, specifically versions up to and including 1.7.0, are affected. The flaw exists in any WordPress installation that has installed this theme.

The CVSS score of 9.8 classifies the flaw as critical, but the EPSS score of less than 1% indicates that exploitation is expected to be rare at present. The flaw is not listed in the CISA KEV catalog. Attackers need no credentials, only a valid user email, and once supplied can gain immediate control. While the lack of known public exploitation and the necessity of insider knowledge reduce the urgency compared to some zero‑day threats, the severity of the impact warrants prompt action.