The vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access control in the themifyme Themify Builder plugin. The flaw enables unauthorized interactions with the plugin’s administrative functionality, potentially exposing internal configuration data or allowing changes to be made without proper permissions. This weakness is classified under CWE-862, reflecting its unauthorized access nature.

WordPress sites running the Themify Builder plugin version 7.6.7 or earlier are affected. The vulnerability applies to all installations of the plugin from the earliest released version up to and including version 7.6.7.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves accessing administrative routes or functions that have been improperly protected by the plugin’s access control settings. An attacker who can reach these endpoints with an unprivileged account or from an exposed site context could gain elevated privileges within the plugin, leading to configuration changes or unintended data exposure.