The flaw is a Cross‑Site Request Forgery vulnerability in the hogash KALLYAS theme that permits an attacker to cause authorized users to submit requests to the WordPress site without their consent. The description does not specify the exact actions that can be triggered, but the vulnerability allows forged requests to be sent from the victim’s browser to the site.

Any WordPress installation using the KALLYAS theme with a version earlier than 4.25.0 is potentially vulnerable. The vulnerability applies to all releases listed as "from n/a through < 4.25.0."

The defect has a CVSS score of 4.3, placing it in the medium severity range, and an EPSS score of less than 1 %, indicating a low exploitation likelihood in the current threat landscape. It is not listed in CISA’s KEV catalog. Attackers would need a user who is authenticated to the site to be tricked into visiting a malicious page that then submits the forged request, resulting in unintended actions performed by that user.