A missing authorization flaw in the extendthemes Vireo theme allows users to gain access to functions that should be restricted, enabling unauthorized modification of theme settings and potential injection of malicious content. The weakness is a classic broken access control issue that could lead to defacement or compromise of the site’s appearance and functionality if exploited. No evidence of remote code execution or data exfiltration is provided; the impact is limited to unauthorized privilege escalation within WordPress.

WordPress installations using the extendthemes Vireo theme version 1.0.24 or earlier are affected. All users with access to WordPress administration who encounter the error may be able to execute privileged actions intended only for higher‑level accounts.

The CVSS score of 4.3 suggests a moderate impact when authenticated. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user with insufficient privileges, as the flaw is described as a missing authorization for incorrectly configured access control security levels. An attacker would need to login to the WordPress site and exploit the theme’s interface to elevate privileges or modify content.