The vulnerability is a missing authorization check in the Makeaholic theme’s code, allowing an attacker to access or modify resources that should be restricted to authorized users. Exploiting incorrect configuration of access control can lead to unauthorized parameter changes, content manipulation, or arbitrary file uploads, potentially compromising site integrity and confidentiality. The flaw is classified under CWE‑862, highlighting an improper enforcement of authorization mechanisms.

The issue affects the Makeaholic theme from ThemeMove for WordPress, specifically all releases up to and including version 1.8.5. The affected component runs within the WordPress ecosystem, typically installed as a theme by site administrators. Any site that has this theme deployed before the vulnerable version is potentially affected.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of active exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to target the web application, likely by sending crafted HTTP requests to endpoints provided by the theme that lack proper authorization checks. The attack vector is inferred to be remote Web, with local privileges not required.