An Incorrect Privilege Assignment flaw in the Jthemes xSmart WordPress theme allows a user with lower permissions to raise their privileges within the site. The weakness, identified as CWE-266, means that the theme’s internal role handling can be manipulated to elevate access rights. The impact is that the attacker could obtain higher privilege levels than originally granted.

All installations of Jthemes the xSmart theme from the earliest release through version 1.2.9.4 are affected. No other WordPress themes or plugins are listed as vulnerable in this entry.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% shows that global exploitation is low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user with limited role who can access theme configuration or upload functionalities; exploiting the theme’s incorrect privilege logic will grant them elevated rights.