A missing authorization flaw in the uxper Sala WordPress theme blinds the plugin to enforcement of access control lists, permitting anyone who can request the theme’s protected functions to use them without proper authentication. This breach of access control can lead to privilege escalation from a low‑privileged visitor to performing actions that should be limited to administrators, potentially compromising site integrity. The flaw, classified as CWE‑862, directly undermines the expected isolation between user roles within the theme’s functionality, revealing a classic broken access control scenario.

The vulnerability impacts the Sala theme developed by uxper. Any deployment of the theme at or below version 1.1.3 is affected. This includes all sites that have installed samples of the theme from its initial release up through the 1.1.3 release inclusive.

With a CVSS score of 7.5, the flaw is considered high severity. The EPSS score is under 1%, indicating the probability of exploitation is presently low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the lack of authorization checks means an attacker could, by simply sending crafted HTTP requests to the theme’s endpoints, trigger the unauthorized operations. The attack path requires only web access to the site and does not depend on additional privileges or special conditions, making the exploitation relatively straightforward if an attacker discovers the exposed functionality.