The Themebeez Toolkit plugin contains a missing authorization flaw that allows an attacker to perform actions beyond the intended user permissions. This broken access control could enable unauthorized modification of content, configuration, or function within the WordPress site, potentially compromising site integrity and availability.

WordPress Themebeez Toolkit plugin versions up to and including 1.3.5 are vulnerable. This includes all sites running themebeez Toolkit within that version range.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s administrative interface, where a user may exploit the lack of proper permission checks to gain elevated privileges or manipulate site components.