The vulnerability arises from a missing authorization check in the uxper Togo theme for WordPress. A missing guard allows a threat actor to access parts of the site that are normally restricted, potentially exposing or manipulating content that should be protected. This weakness, catalogued as CWE‑862, results in a compromise of confidentiality and integrity of site data.

WordPress installations that use the Togo theme version earlier than 1.0.4, including all builds from the initial release through just below 1.0.4. The vendor responsible for the update is uxper.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would likely exploit the flaw by submitting crafted requests to the WordPress instance to reach administrative functions or view content that should be gated, assuming authentication checks fail. It is inferred that the issue can be leveraged remotely via the web interface without any additional privileges.