The vulnerability is a missing authorization flaw in the Consultstreet WordPress theme that allows attackers to bypass the theme’s access control mechanisms. Because the theme fails to verify that a user has the correct permissions before performing privileged actions, an attacker could manipulate or delete content, change theme settings, or execute arbitrary code within the WordPress environment. The weakness maps to CWE‑862, indicating that role‑based access control checks are insufficient or absent.

Any WordPress site that uses the Consultstreet theme from themearile with a version equal to or lower than 3.0.0 is affected. This includes all installations where that theme is active, regardless of the WordPress version. The issue is present throughout the theme’s code base, making every instance of the theme vulnerable until an updated version is applied.

The CVSS score of 4.3 reflects a moderate severity that can lead to moderate impact if the vulnerability is exploited. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw arises from an incorrect configuration of the theme’s security levels, the most likely attack vector would involve an attacker who can authenticate to the WordPress backend or who can otherwise exploit insufficiently protected admin interfaces; however, no public exploit has been reported.