The vulnerability is a missing authorization flaw in the Theater for WordPress plugin that allows an attacker to exploit incorrectly configured access control security levels. This flaw enables unauthorized users to perform actions that should be restricted by the plugin’s role checks, potentially leading to unauthorized content manipulation, deletion, or other administrative functions. The weakness is classified as CWE‑862.

Jeroen Schmit Theatre for WordPress for all releases from the initial release through version 0.18.8 is affected. Sites that have an older or equal version of the plugin installed are at risk.

The CVSS score of 5.3 indicates a moderate impact, though the EPSS score of less than 1% suggests low probability of exploitation. The vulnerability is listed as not in the CISA KEV catalog, implying that no known widespread exploitation has been reported. The most likely attack vector is automated or manual exploitation via the web interface, where an attacker with limited to no privileges could attempt to trigger administrative actions that should be gated by stronger access checks.