The vulnerability is an authentication bypass that arises from the Golo theme’s inability to properly verify authenticated sessions. By exploiting this flaw, an attacker can gain unauthorized access to the WordPress site and execute actions with the privileges of an authenticated user. The weakness is classified as CWE‑288, an Authentication Bypass flaw, and its impact includes potential compromise of confidentiality, integrity, and availability of the site.

The issue affects the WordPress Golo theme supplied by uxper. All installations of the theme from the earliest available version through version 1.7.0 are vulnerable. Site operators should check that the Golo theme is either upgraded or removed if it is present.

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is less than 1%, suggesting that exploitation has not been widely reported, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the web interface of the WordPress site, exploiting the theme’s alternate authentication path or channel as described. While defensive controls such as web application firewalls may reduce exposure, the core requirement for exploitation is that the vulnerable Golo theme remains active on a publicly reachable WordPress installation.