A missing authorization flaw in the xtemos Basel WordPress theme allows an attacker to exploit incorrectly configured access control settings and gain unauthorized access to functionalities that should be protected. The vulnerability can enable an attacker to read, modify, or delete content, potentially leading to confidentiality or integrity breaches. The weakness is classified as CWE-862, indicating that proper authorization checks are not enforced.

The issue affects the xtemos Basel theme for all releases up through version 5.9.1, as indicated by the vendor’s warning. Any installation using these versions is at risk.

The CVSS score of 5.3 points to a medium severity problem, while the EPSS score of less than 1% suggests a relatively low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote web-based request to theme endpoints that are expected to be protected but are not. An attacker would need to identify and send crafted HTTP requests to gain the unintended privileges.