A missing authorization check in the Bard WordPress theme allows an attacker to exploit incorrectly configured access control settings. The weakness stems from a flaw in permission handling (CWE-862) and enables users who should not have certain capabilities to perform privileged actions. While the vulnerability does not provide remote code execution or full system takeover, it can be used to expose or modify sensitive content, degrade site integrity, or create a foothold for further attacks. The attack vector is inferred because it is not explicitly detailed in the CVE description.

WordPress sites using the Bard theme from any version up to and including 2.229 are impacted. This includes installations by the vendor wproyal. The vulnerability is present in all pre-2.230 builds without any additional configuration.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have access to a user account that is incorrectly granted higher privileges or to manipulate access control levels exposed by configuration errors. Once exploited, the attacker can access administrative functions such as content editing, plugin installation, or user management, potentially compromising the entire site.