The CVE details a missing authorization flaw in the Masterstudy WordPress theme by StylemixThemes that allows attackers to invoke functions that should be guarded by access control lists. Because the theme omits proper ACL enforcement, a user who can reach the vulnerable endpoints can read or modify data intended only for privileged users, potentially compromising the confidentiality, integrity, and availability of the site.

All installations of the Masterstudy theme built by StylemixThemes that use a version earlier than 4.8.122 are affected. This includes every release from the theme’s initial distribution up through the 4.8.121 release, as the vulnerability is documented for all versions in that range.

The CVSS score of 7.5 places this vulnerability in the high‑severity range, while the EPSS score of less than 1 % indicates a low chance of exploitation at present. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via a web‑based request to administrative or API endpoints that lack proper role checks; an attacker would need to identify such an endpoint and send a crafted request, but the missing authorization removes the usual permission barriers.