The Houzez theme contains an IDOR flaw that lets an attacker manipulate a user‑controlled key to access data not meant for them. The vulnerability falls under CWE‑639 and can expose personal or product information belonging to other site users. The flaw is not a remote code execution or privilege escalation beyond data exposure; it simply bypasses intended access controls.

Favethemes Houzez theme versions starting from the first release up through 4.2.5 are affected. No specific earlier release is listed, but all versions up to and including 4.2.5 may contain the flaw.

The CVSS score of 6.5 signifies a moderate severity impact. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA KEV. Attackers are expected to exploit the weakness by feeding a crafted key or URL parameter to bypass authorization checks. While the description does not specify a network requirement, such IDOR attacks can typically be carried out over the web by anyone who can guess or intercept the vulnerable URL.