The Houzez WordPress theme contains a missing authorization flaw that lets an attacker invoke features that should be protected by access control lists. An attacker can interact with privileged functions without possessing the necessary roles or permissions, potentially exposing sensitive data or allowing further exploitation. The weakness corresponds to CWE-862: Missing Authorization.

WordPress sites running the Houzez theme version 4.1.1 or earlier are affected. The vulnerability impacts all installations of the theme that have not yet applied the update released to version 4.1.4, which addresses the control checks.

The CVSS score of 8.5 indicates high severity, but the EPSS score of less than 1 % shows a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation would occur via crafted HTTP requests to the theme’s administrative endpoints, bypassing the intended role checks. The attack would be possible from any web-facing user and would allow unauthorized actions against the WordPress site.