A flaw in WordPress sites that use the Sonaar theme up to version 4.27.4 lets an attacker with a subscriber account elevate their privileges beyond the intended restrictions. The vulnerability bypasses internal access controls, allowing the attacker to perform actions normally reserved for higher‑privileged roles, such as creating, editing, or deleting content, thereby compromising the confidentiality, integrity, and availability of the site.

The issue affects the Sonaar WordPress theme published by SONAAR MUSIC. All releases up to and including 4.27.4 are vulnerable; version 4.27.5 and later contain the necessary fix.

The CVSS score of 8.8 classifies this as a severe vulnerability. EPSS data is not available, but the lack of a CISA KEV listing does not mitigate the risk. The attack vector is likely an authenticated visitor with a subscriber role who exploits theme code that incorrectly grants elevated permissions. Any site running a vulnerable version is at risk of privilege escalation.