The vulnerability resides in the Houzez theme for WordPress where authorization checks are missing, allowing attackers to access pages or functions that should be restricted. The flaw arises from incorrectly configured access control security levels and can enable an attacker to gain privileges beyond those intended for the user account. While the CVSS score suggests moderate severity, the impact can compromise sensitive site content or administrative operations if exploited.

The issue affects the favethemes Houzez WordPress theme for all releases from the initial release up to and including version 4.0.4. Site administrators running any of these versions are susceptible until an update is applied.

With a CVSS score of 4.3 and an EPSS score of less than 1%, the probability of exploitation is currently considered very low. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread use. However, the attack vector is inferred to be remote over the web, where an unauthenticated or low‑privilege user could traverse into restricted areas, likely requiring only the ability to access the site via a browser. The recommended mitigation is to update promptly to prevent any potential unauthorized activity.