The vulnerability stems from incorrect privilege assignment in the Togo WordPress theme. It allows an attacker who can trigger code execution within the theme to assume higher privileges than the account they start with. Identified as CWE‑266, this flaw lets a user with limited permissions perform functions that should be restricted to administrators, potentially exposing site data and configuration.

All installations of the uxper Togo theme older than version 1.0.4 are affected. Versions from the initial release through, but not including, 1.0.4 contain the flaw, so any site running Togo 1.0.3 or earlier remains vulnerable.

The CVSS score of 8.8 signals high severity, while the EPSS score of less than 1 % and the absence from the CISA KEV catalog imply low current exploitation probability. Nonetheless the flaw can be abused by an authenticated WordPress user via the theme’s activation or configuration interface. The likely attack vector is an attacker with at least editor access executing privileged theme code, which could result in administrator-level capabilities across the site.